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^ communicatively coupled to the UNC via an IP network. The URR messages are sent between MSs and UNCs using an Up interface 
^ comprising a set of layered protocols over an underlying IP transport. 
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MESSAGING IN AN UNLICENSED MOBILE ACCESS 
TELECOMMUNICATIONS SYSTEM 

CROSS-REFERENCE TO RELATED APPLICATIONS 

[0001] This application claims the priority of provisional patent application Serial 
No. 60/571,421, filed May 14. 2004, and entitled "Up Interface Stage 3 Description." 
This application is a Continuation in Part of and clainis the priority of U.S. Non- 
provisional Application Serial No. 11/013,883, entitled "Apparatus and Method for 
Extending the Coverage Area of A Licensed Wireless Communication System Using 
an Unlicensed Wireless Communication System," filed December 15, 2004, which is a 
Continuation in Part of U.S. Non-provisional Application Serial No. 10/688,470, 
entitled "Apparatus and Method for Extending the Coverage Area of a Licensed 
Wireless Communication System Using an Unlicensed Wireless Communication 
System," filed October 17, 2003. This application is also a Continuation in Part of and 
claims the priority of U.S. Non-provisional Application Serial No. 11/097,866, entitled 
"A Method and System for Registering an Unlicensed Mobile Access Subscriber with a 
Network Controller," filed March 31, 2005, which claims priority to provisional patent 
application Serial No. 60/564,696, filed April 22, 2004 and entitled "UMA Network 
Controller (UNC) Selection and UMA Location Services Support Mechanisms." 
[0002] This application is also related to commonly owned U.S. Applications: 
Serial No. 10/115,833, entitled "Unlicensed Wireless Communications Base Station to 
Facilitate Unlicensed and Licensed Wireless Communications with a Subscriber 
Device, and Method of Operation," filed April 2, 2002; and Application Serial No. 
10/251,901, entitled "Apparatus for Supporting the Handover of a Telecommunication 
Session between a Licensed Wireless System^ and an Unlicensed Wireless System," 
filed September 20, 2002, the contents of each of which are hereby incorporated by 
reference. In addition, this application contains conmion subject matter disclosed in 

U.S. Applications: Serial Nos. , Attorney Matter Nos. 007090.P032, 

007090.P032, 007090.P032, filed on May 12, 2005. 

FIELD OF THE INVENTION 

[0003] The field of invention relates generally to teleconmaunications. More 
particularly, this invention relates to messaging employed in an unlicensed mobile 
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access (UMA) telecommunication system that includes both licensed and unlicensed 
radio infrastructure. 

BACKGROUND INFORMATION 

[0004] Licensed wireless systems provide mobile wireless communications to 
individuals using wireless transceivCTS. Licensed wireless systems refer to public 
cellular telephone systems and/or Personal Communication Services (PCS) telephone 
systems. Wireless transceivers include cellular telephones, PCS telephones, wireless- 
enabled personal digital assistants, wireless modems, and the like. 
[0005] Licensed wireless systems utilize wireless signal frequencies that are 
licensed from governments. Large fees are paid for access to these frequencies. 
Expensive base station (BS) equipment is used to support communications on licensed 
frequencies. Base stations are typically installed approximately a mile apart from one 
another (e.g„ cellular towers in a cellular network). The wireless transport mechanisms 
and frequencies employed by typical licensed wireless systems limit both data transfer 
rates and range. As a result, the quality of service (voice quality and speed of data 
transfer) in licensed wireless systems is considerably inferior to the quality of service 
afforded by landline (wired) connections. Thus, the user of a licensed wireless system 
pays relatively high fees for relatively low quality service. 

[0006] Landline (wired) connections are extensively deployed and generally 
perform at a lower cost with higher quality voice and higher speed data services. The 
problem with landline connections is that they constrain the mobility of a user. 
Traditionally, a physical connection to the landline was required. 
[0007] In the past few years, the use of unlicensed wireless communication systems 
to facilitate mobile access to landline-based networks have seen rapid growth. For 
example, such unlicensed wireless systems may support wireless communication based 
on the IEEE 802.11a, b or g standards (WiFi), or the Bluetooth™ standard. The 
mobility range associated with such systems is typically on the order of 100 meters or 
less. A typical unlicensed wireless communication system includes a base station 
comprising a wireless access point (AP) with a physical connection (e,g., coaxial, 
twisted pair, or optical cable) to a landline-based network. Tlie AP has a RF 
transceiver to facilitate conununication with a wireless handset that is operative within 
a modest distance of the AP, wherein the data transport rates supported by the WiFi and 
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Bluetooth™ Standards are much higher than those supported by the aforementioned 
licensed wireless systems. Thus, this option provides higher quality services at a lower 
cost, but the services only extend a modest distance from the base station. 
[0008] Currently, technology is being developed to integrate the use of licensed and 
unlicensed wireless systems in a seamless fashion, thus enabling a user to access, via a 
single handset, an unlicensed wireless system when within the range of such a system, 
while accessing a licensed wireless system when out of range of the unlicensed wureless 
system, unlicensed wireless networks and for directing them to an appropriate network 
controller. In order to support more rapid implementation by various vendors, a 
standardized set of messages for performing various functions, such at registration, 
channel activation, handover, and the like are needed. 
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SUMMARY OF THE INVENTION 
[0009] In accordance with aspects of the present invention, techniques are disclosed 
for performing messaging between mobile stations (MSs) and UMA network 
controllers (UNCs) in an unlicensed mobile access network (UMAN). To facilitate 
various operations, URR (UMA radio resource) messages are exchanged between an 
MS and one or more UNCs operating in the UMAN. By employing a wireless link 
using an unlicensed radio frequency, such as an 802.11-based link or a BluetoothTM 
link, the MS may access the UMAN via a wkeless access point (AP) that is 
communicatively-coupled to the UNC via an IP network. The URR messages are sent 
between the MS and the UNC using an Up intaface comprising a set of layered 
protocols over an underlying IP transport. 

[0010] In another aspect of the present invration, URR messages with specific 
formats are disclosed. Each of the URR messages includes a basic set of information 
elements (lEs) including a protocol discriminator, a skip indicator, and a message type 
via which die message may be identified. Further IBs relevant to each particular URR 
handover message are also disclosed. 
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BRIEF DESCRIPTION OF THE DRAWINGS 
[0011] The foregoing aspects and many of the attendant advantages of this 
invention will become more readily appreciated as the same becomes better understood 
by reference to the following detailed description, when taken in conjunction with the 
accompanying drawings, wherein like reference nximerals refer to like parts throughout 
the various views unless otherwise specified: 

[0012] The foregouig aspects and many of the attendant advantages of this 
invention will become more readily appreciated as the same becomes better imderstood 
by reference to the following detailed description, when taken m conjunction with the 
accompanying drawings, wherein like reference numerals refer to like parts throughout 
the various views unless otherwise specified: 

[0013] Figure 1 A provides an overview of the uidoor access network (IAN) mobile 
service solution in accordance with one embodiment of the present invention; 
[0014] Figure IB illustrates protocol layers of a mobile set in accordance with one 
embodiment; 

[0015] Figure IC illustrates a method of protocol conversion in accordance with 
one embodiment; 

[0016] Figure 2A illustrates an overview of a level 1, level 2, and level 3 GSM- 
related protocol architecture for one embodiment of a mobile station that provides 
unlicensed radio links via Bluetooth signaling; 

[0017] Figure 2B illustrates an overview of a level 1, level 2, and level 3 GSM- 
related protocol architecture for one embodiment of a mobile station that provides 
unlicensed radio links via IEEE 802.11 signaling; 

[0018] Figure 3A illustrates the Up interface protocol architecture in support of CS 
Domain signaling, as well as UMA-specific signaling, according to one embodiment; 
[0019] Figure 3B shows Bluetooth lower layers employed by a mobile station and 
access pomt to facilitate physical layer communications; 

[0020] Figure 3C shows Bluetooth lower layers employed by a mobile station and 
access point to facilitate physical layer communications; 

[0021] Figure 3D illustrates the Up CS domain voice bearer protocol architecture in 
support of GSM voice transmission, according to one embodhnent; 
[0022] Figure 3E illustrates the Up GPRS user plane protocol architecture, 
according to one embodhnent; 
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[0023] Figure 3F illustrates the Up protocol architecture in support of GPRS 
Signaling, according to one embodiment; 

[0024] Figure 4 illustrates several possible GSM and UMA coverage scenarios in 
accordance with one embodiment; 

[0025] Figure 5 illustrates exemplary mobility management functions in one 
embodiment; 

[0026] Figure 6A illustrates a URR Register message exchange corresponding to a 
successful registration; 

[0027] Figure 6B illustrates a URR Register message exdiange corresponding to a 
rejected registration; 

[0028] Figure 6C illustrates a URR Register message exchange under which an MS 
is redirected from a first UNC to a second UNC; 

[0029] Figure 7 is a table illustrating one embodiment of a URR REGISTER 
REQUEST message format; 

[0030] Figure 8A is a table illustrating one embodiment of a URR REGISTER 

ACK message format; 

[0031] Figure 8B is a table illustrating one embodiment of a UMA GSM System 
Information information element; 

[0032] Figure 9 is a table illustrating one embodiment of a URR REGISTER 
REJECT/REDIRECT message format; 

[0033] Figure lOA illustrates a URR message sequence including a URR 
REGISTER UPDATE UPLINK message and a URR REGISTER REDIRECT 
message; 

[0034] Figure lOB illustrates a URR message sequence including a URR 
REGISTER UPDATE DOWNLINK message, a URR DEREGISTER message, and a 
URR REGISTER REDIRECT message; 

[0035] Figure 11 is a table illustrating one embodiment of a URR REGISTER 
UPDATE UPLINK message format; 

[0036] Figure 12 is a table illustrating one embodiment of a URR REGISTER 
UPDATE DOWNLINK message format; 

[0037] Figure 13 is a table illustrating one embodiment of a URR DEREGISTER 
message format; 
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[0038] Figure 14 is a table illustrating one embodiment of a lookup table containing 

8-bit values corresponding to causes for various URR actions; 

[0039] Figure 15 illustrates a channel activation message sequence; 

[0040] Figure 16 is a table illustrating one embodiment of a URR ACTIVATE 

CHANNEL message format; 

[0041] Figure 17 is a table illustrating one embodiment of a URR ACTIVATE 
CHANNEL ACK message format; 

[0042] Figure 18 is a table illustrating one embodiment of a URR ACTIVATE 
CHANNEL FAILURE message format; 

[0043] Figure 19 is a table iUustrating one embodiment of a URR ACTIVATE 
CHANNEL COMPLETE message format; 

[0044] Figure 20 illustrates a handover message sequence initiated by a mobile 
station; 

[0045] Figure 21 is a table illustrating one embodiment of a URR HANDOVER 
ACCESS message format; 

[0046] Figure 22 is a table illustrating one embodiment of a URR HANDOVER 
COMPLETE message format; 

[0047] Figure 23 A illustrates a handover message sequence mitiated in response to 
a URR UPLINK QUALITY INDICATION message sent from a UNC; 
[0048] Figure 23B illustrates a handover message sequence initiated in response to 
a URR UPLINK QUALITY INDICATION message sent from a UNC, in accordance 
with a handover failure; 

[0049] Figure 24 is a table illustratmg one embodiment of a URR UPLINK 
QUALITY INDICATION message format; 

[0050] Figure 25 is a table illustrating one embodiment of a URR HANDOVER 
REQUIRED message format; 

[0051] Figure 26A and 26B are table portions illustrating one embodiment of a 
URR HANDOVER COMMAND message fonnat; 

[0052] Figure 27 is a table Ulustrating one embodiment of a URR HANDOVER 
FAILURE message format; 

[0053] Figure 28 illustrates a URR CLEAR REQUEST message sent from a mobile 
station to a UNC; 
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[0054] Figure 29 is a table illustrating one embodiment of a URR CLEAR 
REQUEST message format; 

[0055] Figure 30 illustrates a URR release message sequence initiated by a UNC; 
[0056] Figure 31 is a table illustrating one embodiment of a URR RR RE1£ASE 
message format; 

[0057] Figure 32 is a table illustrating one embodiment of a URR RR RELEASE 
COMPLETE message format; 

[0058] Figure 33 illustrates a URR paging message sequence initiated by a UNC; 
[0059] Figure 34 is a table illustrating one embodiment of a URR PAGING 
REQUEST message format; 

[0060] Figure 35 is a table illustrating one embodiment of a URR PAGING 
RESPONSE message format; 

[0061] Figure 36 illustrates a URR classmaik message sequence initiated by a 
UNC; 

[0062] Figure 37 is a table illustrating one embodiment of a URR CLASSMARK 
ENQUIRY message format; 

[0063] Figure 38 is a table illustrating one embodiment of a URR CLASSMARK 

CHANGE message format; 

[0064] Figure 39 is a schematic block diagram illustrating one embodiment of a 
high-level architecture of a UNC; and 

[0065] Figure 40 is a schematic block diagram illustrating one embodiment of a 
high-level architecture of a mobile station. 
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DETAILED DESCRIPTION 
[0066] In the following description, numerous specific details are set forth to 
provide a thorough understanding of embodiments of the invention. One skilled in the 
relevant art will recognize, however, that the invention can be practiced without one or 
more of the specific details, or with other methods, components, materials, etc. In other 
instances, well-known structures, materials, or operations are not shown or described in 
detail to avoid obscuring aspects of the invention. 

[0067] RefCTcnce throughout this specification to "one embodiment" or "an 
embodiment" means that a particular feature, structure, or characteristic described in 
connection with the embodiment is included in at least one embodiment of the present 
invention. Thus, the appearances of the phrases "mi one embodiment" or "in an 
embodiment" in various places throughout this specification are not necessarily all 
referring to the same embodiment. Furthermore, the particular features, structures, or 
characteristics may be combined in any suitable manner in one or more embodiments. 
[0068] In the present description the unlicensed wireless system may be a short- 
range wireless system, which may be described as an "indoof solution. However, it 
will be understood through the application that the unlicensed wireless system includes 
unlicensed wireless systems that cover not only a portion of a building but also local 
outdoor regions, such as outdoor portions of a corporate campus serviced by an 
unlicensed wireless system. The mobile station may, for example, be a wireless phone, 
smart phone, personal digital assistant, or mobile computer. The "mobile station" may 
also, for example, be a fixed wireless device providing a set of terminal adapter 
functions for connecting Integrated Services Digital Network (ISDN) or Plain Old 
Telephone Service (POTS) terminals to the wireless system. Application of the present 
invention to this type of device enables the wireless service provider to offer so-called 
landline replacement service to users, even for user locations not sufficiently covered 
by the licensed wireless system. The present description is in the context of the UMA 
(Unlicensed Mobile Access) standardized architecture as promulgated by the UMA 
consortium. However, the invention is not so limited. 

[0069] Throughout the following description, acronyms commonly used m the 
telecommunications industry for wireless services are utilized along with acronyms 
specific to the present invention. A table of acronyms specific to this application is 
included in Appendix 1. 
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[0070] Figure lA illustrates an Unlicensed Mobile Access (UMA) architecture 100 
in accordance with one embodiment of the present invention. UMA architecture 100 
enables a user of a mobile station 102 to access a voice and telecommunications 
network 104 via either a licensed wireless communications session 106, or an 
unlicensed wkeless communication session 108. The telecommunications network 104 
includes a mobile switching center (MSG) 110, which provides access to a voice 
network 112, and a Serving GPRS (General Packet Radio Service) Support Node 
(SGSN) 114. which provides access to a data network 116. MSG 110 also provides an 
internal visitor location register (VLR) function. 

[0071] In further detail, the licensed wireless communication session is facilitated 
by infrastructure provided by a licensed wkeless network 118 that includes 
telecommunications network 104. In the illustrated embodiment, licensed wkeless 
network 118 depicts components common to a GSM-(Global System for Mobile 
Gommunication) based cellular netwodc that includes multiple base transceiver stations 
(BTS) 120 (of which only one is shown for sknplicity) that facilitate wkeless 
communication services for various mobile stations 102 via respective licensed radio 
links 122 (e.g,, radio links employing radio frequencies withm a licensed bandwidth). 
Typically, the multiple BTSs 120 are configured ui a cellular configuration (one per 
each cell) that covers a wide service area. The various BTSs 120 for a given area or 
region are managed by a base station controller (BSC) 124, with each BTS 120 
communicatively-coupled to its BSC 124 via a private trunk 126, In general, a large 
licensed wkeless network, such as that provided by a regional or nationwide mobile 
services provider, will include multiple BSCs 124. 

[0072] Each BSC 124 conmiunicates with telecommunications network 104 
through a standard base station controller mterface 126. For example, a BSC 124 may 
communicate with MSG 110 via the GSM A-mterface for ckcuit switched voice 
services and with SGSN 114 via the GSM Gb interface for packet data services 
(GPRS). Conventional licensed voice and data networks 104 include protocols to 
permit seamless handoffs from one recognized BSC 124 to another BSC (not shown). 
[0073] An imlicensed communication session 108 is facilitated via an (wkeless) 
access pokit (AP) 128 comprismg an mdoor base station 130. Typically, AP 128 will 
be located m a fixed structure, such as a home 132 or an office buildmg 134. The 
service area of indoor base station 130 includes an indoor portion of a building, 
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although it will be understood that the service area of an indoor base station may 
include an outdoor portion of a building or campus. As indicated by the arrow 
representing unlicensed commimication session 108, the mobile station 102 may be 
connected to the telecommunications network 114 via a second data path that includes 
an unlicensed wireless channel 136, access point 128, an access network 138, and an 
unlicensed mobile access network controller (UNC) 140. The UNC 140 communicates 
with telecommimications network 104 using a base station controller interface 126B 
that is similar to base station controller interface 126A, and includes a GSM A interface 
and Gb interface. AP 128 may include software entities stored in memory and 
executing on one or more microprocessors (not shown in Figure lA) adapted to 
perform protocol conversion. 

[0074] The unlicensed wireless channel 136 is facilitated by a radio link employing 
a wavelength (or wavelwigth range) in an unlicensed, free spectrum (e.g., spectrum 
around 2.4 GHz, 5 GHz, 11-66 GHz). An unlicensed wireless service hosting 
unlicensed wireless channel 136 may have an associated communication protocol. As 
examples, the unlicensed wireless service may be a Bluetooth™ compatible wireless 
service, or a wireless local area network (LAN) (WiFi) service (eg., the JEEE 802.11a, 
b, or g wireless standard). This provides the user with potentially improved quality of 
service in the service regions of the unlicensed wireless service {ie., within the service 
range of a corresponding AP). Thus, when a subscriber is within range of the 
unlicensed AP, the subscriber may enjoy low cost, high speed, and high quality voice 
and data services. In addition, the subscriber enjoys extended service range since the 
handset can receive services deep widiin a building at locations that otherwise may not 
be reliably serviced by a licensed wireless system. At the same time, the subscriber can 
roam outside the range of the unlicensed AP without dropping commxmications. 
Instead, roaming outside the range of the unlicensed AP results in a seamless handoff 
(also referred to as a handover) wherein conamunication services are automatically 
provided by the licrased wireless system, as described in more detail in U.S. Pat App. 
Ser. No. 10/115,833, the contaits of which are hereby incorporated by reference. 
[0075] Mobile station 102 may include a microprocessor and memory (not shown) 
that stores computer program instructions for executing wireless protocols for 
managing communication sessions. As illustrated in Figure IB, in one embodiment the 
mobile station 102 mcludes a layer 1 protocol layer 142, layer 2 protocol layer 144, and 
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a layer 3 signaling protocol layer for the licensed wireless service that mcludes a radio 
resource (RR) sublayer 146, a mobility management (MM) sublayer 148, and a call 
management (CM) layer 150. It will be understood that the level 1, level 2, and level 3 
layers may be implemented as software modules, which may also be described as 
software "entities." In accordance with a common nomenclature for licensed wireless 
services, layer 1 is the physical layer, ie., the physical baseband for a wireless 
communication session. The physical layer is the lowest layer of the radio mterface 
and provides functions to transfer bit streams over physical radio links. Layer 2 is the 
data link layer. The data link layer provides signaling between the mobile station and 
the base station controller. The RR sublayer is concerned with the management of an 
RR-session, which is the time that a mobile station is in a dedicated mode, as well as 
the configuration of radio channel, power controller, discontinuous transmission and 
reception, and handovers. The mobility management layer manages issues that arise 
from the mobility of the subscriber. The mobility management layer may, for example, 
deal with mobile station location, security functions, and authentication. The call 
control management layer provides controls for end-to-end call establishment. These 
functions for a licensed wireless system are well known by those in the art of wireless 
conmnmication. 

[0076] The mobile station may also include an unlicensed wireless service physical 
layer 152 (/.e, a physical layer for unlicensed wireless service such as Bluetooth, WiFi, 
or other unlicensed wireless channel (e.g.y WiMAX)). The mobile station also includes 
an unlicensed wireless service level 2 link layer 154, and an unlicensed wireless service 
radio resource sublayer(s) 156, An access mode switch 160 is included for the mobile 
management 148 and call management layers 150 to access the unlicensed wireless 
service radio resource sublayer 156 and unlicensed wireless service link layer 154 when 
the mobile station 102 is within range of an imlicensed AP 128 and to support 
switching between licenced RR sublayer 146 and unlicensed wireless service RR 
sublayer 156. 

[0077] The unlicensed radio resource sublayer 156 and imlicensed link layer 154 
may include protocols specific to the unlicensed wireless service utilized in addition to 
protocols selected to facilitate seamless handoff between licensed and unlicensed 
wireless systems. Consequently, the unlicensed radio resource sublayer 156 and 
unlicensed link layer 154 need to be converted into a format compatible with a 

12 



wo 2005/114918 



PCTAJS2005/016767 



conventional base station controller interface protocol 126 recognized by a MSC, 
SGSN, or other voice or data network, 

[0078] Referring to Figure IC, in one embodiment of the present invention, the 
mobile station 102, AP 128 and UNC 140 provide an interface conversion function to 
convert the level 1, level 2, and level 3 layers of the unlicensed service into a 
conventional base station subnetwork (BSS) interface 126B (e.g., an A-interface or a 
Gb-interface). As a result of the protocol conversion, a communication session may be 
established that is transparent to the voice network/data network 104, i.e., the 
voice/data network 104 uses its standard interface and protocols for the conmiunication 
session as it would with a conventional conmiunication session handled by a 
conventional base transceiver station. For example, in some embodiments the mobile 
station 102 and UNC 140 are configured to initiate and forward location update and 
service requests. As a result, protocols for a seamless handoff of services that is 
transparent to voice/data network 104 are facilitated. This permits, for example, a 
single phone number to be used for both the licensed wireless service and the 
unlicensed wireless service. Additionally, the presoit invention permits a variety of 
services that were traditionally offered only through licensed wireless services to be 
offered through an unlicensed wireless service. The user thus gets the benefit of 
potentially higher quality service when their mobile station is located within the area 
serviced by a high bandwidth unlicensed wireless service while also having access to 
conventional phone services. 

[0079] The licensed wireless service may comprise any licensed wireless service 
having a defined BSS interface protocol 126 for a voice/data network 104. In one 
embodiment, the licensed wireless service is a GSM/GPRS radio access network, 
although it will be understood that embodiments of the present invention include other 
licensed wireless services. For this embodiment, the UNC 140 interconnects to the 
GSM core network via the same base station controller interfaces 126 used by a 
standard GSM BSS network element. For example, in a GSM application, these 
interfaces are the GSM A-interface for circuit switched voice services and the GSM Gb 
interface for packet data services (GPRS). In a UMTS (Universal Mobile 
Telecommunications System) application of the invention, the UNC 140 interconnects 
to the UMTS network using a UMTS lu-cs interface for circuit switched voice services 
and the UMTS lu-ps interface for packet data services, hi a CDMA application of the 
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invention, the UNC 140 interconnects with the CDMA network using the CDMA Al 
and A2 interfaces for circuit switched voice services and the CDMA AlO and All 
interfaces for packet data services. 

[0080] In a GSM/GPRS embodiment, UNC 140 appears to the GSM/GPRS core 
network as a GSM BSS network element and is managed and operated as such. In this 
architecture the principle elements of transaction control {e.g., call processing) are 
provided by higher network elements; namely the MSC 110 visitor location register 
(VLR) and the SGSN 114. Authorized mobile stations are allowed access to the 
GSM/GPRS core network either directly through the GSM radio access network if they 
are outside of the service area of an AP 128 or via the UMA network system if they are 
within the service area of an AP. 

[0081] Since a communication session hosted by the UMA architecture 100 is 
transparent to a voice networic 1 12 or data network 1 16, the unlicensed wireless service 
may support all us« services that are typically offered by a wireless service provider. 
In the GSM case, this typically includes the following basic services: Telephony, 
Emergency call (e.g., E911 callmg in North America); Short message, naobile- 
terminated point-to-point (MT/PP); Short message, mobile-originated point-to-point 
(MO/PP); GPRS bearer services; and Handover (outdoor-to-mdoor, indoor-to-outdoor, 
voice, data, SMS, SS). Additionally, GSM may also support, various supplemraitary 
services that are well-known in the art. 

[0082] Figure 2A provides an overview of a level 1, level 2, and level 3 GSM- 
related protocol architecture for one embodiment of mobile station 102 that provides 
unlicensed radio links via Bluetooth signaling. As Ulustrated, there are two logical 
radio resource (RR) management entities: the GSM RR entity 202 and the UMA-RR 
entity 204. The protocol architecture includes a GSM baseband level 1 layer 206, GSM 
level 2 link layer (LAPDm) 208, Bluetooth baseband level 1 layer 210, Bluetooth level 
2 layws 211 including a layer 2 connection access procedure (L2CAP) layer 212 and a 
BNEP layer 213, an access mode switch 214, and iq>per laya: protocols 216. When the 
mobUe station is operating in an UMA mode, the UMA-RR entity 204 is the current 
"serving" RR entity providing SCTvice to the mobility management (MM) sublayer via 
the designated service access point (RR-SAP). The GSM RR entity is detached from 
flie MM sublayer in this mode. Hie UMA-RR entity 204 provides a new set of 
functions, and is responsible for several tasks. Fust the UMA-RR entity is responsible 
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for discovery of UMA coverage and UMA registration. Second, the UMA-RR entity is 
responsible for emulation of the GSM RR layer to provide the expected services to the 
MM layer; Le., create, maintain and tear down RR connections. All existing GSM 
04.07 primitives defined for the RR-SAP apply. The plug-in of UMA-RR entity 204 is 
made transparent to the upper layer protocols in this way. Third, a UMA-RR entity 204 
module is responsible for coordination with the GSM RR entity to manage access mode 
switching and handover, as described in further detail in Application Serial No. 
10/688,470 referenced above. 

[0083] Figure 2B provides an overview of a level 1, level 2, and level 3 GSM- 
related protocol architecture for one embodhnent of mobile station 102 that provides 
unlicensed radio links via IEEE 802.11 signaling. All of the entities and layers are the 
same as described above for Figure 2A, except that the Bluetooth layers have been 
replaced with an 802.11 PHY layer 218 and an 802.11 MAC layer 220. 
[0084] Figure 3A illustrates the Up interface protocol architecture in support of 
circuit switched (CS) Domain signaling, as well as UMA-specific signaling, according 
to one embodiment. The MSG sublayers are conventional, well known features known 
in the art in regards to the message transfer part (MTP) interfaces MTPl 302, MTP2 
304, and MTP3 306, signaling connection control part (SCCP) 308, base station system 
application part (BSSAP) 310, mobility management interface 312, and connection 
management interface 314. 

[0085] The UMA-RR protocol supports the UMA "layer 3" signaling functions via 
UMA-RR layers 204 provided by each of the mobile station 102 and UNC 140. The 
UNC 140, acting like a BSC, terminates UMA-RR protocol messages and is 
responsible for the interworking between these messages and the analogous A-interface 
messages. 

[0086] The layers below the UMA-RR layer 204 m each of mobile station 104 and 
UNC 140 include a TCP layer 316, a remote IP layer 318, and an IPSec (IP security) 
layer 320. As an option, a standard Secure Socket Layer (SSL) protocol running over 
TCP/IP (not shown) may be deployed in place of IPSec layer 320. 
[0087] Lower-level IP connectivity between mobile station 102 and UNC 140 is 
supported by appropriate layers hosted by an intervening access point 128 and 
broadband IP network 138 (i.^., the access network 138 shown in Figure lA). The 
componrats for supporting the IP transport layer (f.e., the conventional network layer 3 
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under the seven-layer OSI model) include a transport IP layers 322 for each of the 
mobile station 104, AP 128, and IP network 138, and an IP layer 322A at UNC 140. 
[0088] At the lowest layers the physical and data link layers), mobile station 
104 and AP 128 are depicted as providing unlicensed lower layers 324, while each of 
AP 128, IP network 138, and UNC 140 provide appropriate access layers 326. 
Typically, access layers 326 will include conventional Ethernet PHY and MAC layers 
(IEEE 802.3), although this is not limiting. 

[0089] As shown in Figures 3A and 3B, Ihe unlicensed layers lower layers 324 will 
depend on whether the unlicraised radio link uses Bluetooth signaling or lEEB 802.11 
signaling. The Bluetooth lower layrars depicted in Figure 3A conespond to the mobile 
station architecture of Figure 2A, and include a Bluetooth baseband layer 210, an 
L2CAP layer 212, and a BNEP layer 213. MeanwhUe, the 801.11 lower layers shown 
in Figure 3B correspond to the mobile station architecture of Figure 2B, and include a 
802.11 PHY layer 218 and in 802.1 1 MAC layra: 220. 

[0090] Figure 3D illustrates the Up CS domain voice bearer protocol architecture in 
support of GSM voice transmission, according to one embodiment hi addition to the 
like named and rrferenced components common to the ardiitectures of Figure 3D and 
3C, facilities are provided for supporting GSM voice transmission. For the MSC 110, 
these components include conventional components for supporting GSM voice 
transmissions, and are depicted as physical layers 330 and audio 332. with similar 
components being deployed in UNC 140. Each of mobUe station 102 and UNC 140 
now include a GBEIAN (GSM Edge Radio Access Network) codec 334 and an 
RTP/UDP layer 336. 

[0091] Under the architecture of Figure 3D, audio flows over the Up interface 
according to the RTP ftaming format defined in RFC 3267 and RFC 3551. When 
operating m UMA mode, support for AMR FR as specified in TS 26.103 is supported. 
Other codecs may also be supported, sudi as G.7 1 1 . 

[0092] Figure 3E illustrates the Up GPRS user plane protocol architecture, 
according to one embodunent The Up GPRS user plane protocol architecture 
effectively enables die bmnelmg of GPRS signalmg and data packets through the 
UNC 140 utilizing the unlicensed spectrum, thus supporting a tunneling function for 
packet-switdied traffic between tiie mobile station 102 and SGSN 118. 
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[0093] As illustrated in Figure 3E, each of the UNC 140 and SGSN 114 employ 
conventional facilities for supporting GPRS signaling and data packets, including a 
physical layer 350, a network service layer 352, and a BSSGP layer 354. Each of 
mobile station 102 and UNC 140 include a UDP layer 356 and a UMA-RLC layer 358. 
Each of mobile station 102 and SGSN include an LLC layer 360 and an SNDCP layer 
362. Mobile station 102 also includes an IP layer 364. 

[0094] Under the architecture of Figure 3E, GPRS LLC PDUs carrying data, and 
higher layer protocols, are carried transparently between the mobile station 102 and 
SGSN 114. This allows the mobile station to derive all GPRS services in the same 
manner as if it were in a GERAN BSS, All existing GPRS applications and MMI in 
mobile station 102 are unchanged. LLC PDUs are carried over UMA-RLC layer 358 
from mobUe station 102 to UNC 140, which relays the PDUs over to SGSN 114 using 
BSSGP messaging. The UMA-RLC layer 358 runs directly over the UDP layer 356 to 
leverage the IP bearer service. 

[0095] Figure 3F illustrates the Up protocol architecture in support of GPRS 
Signaling, accordmg to one embodiment Under this architecture, the GPRS LLC 
PDUs for signaling on higher layer protocols (including upper layers 366) are carried 
transparently bet>yeen MS 102 and SGSN 114. This allows the MS to obtain all GPRS 
services in the same ways as if it were connected to a GERAN BSS. The GPRS-RLC 
protocol is replaced with an equivalent (from the upper layer perspective) UMA-RLC 
protocol. Reliability is ensured by TCP layer 357. As in a GERAN BSS, the UNC, 
acting like a BSC, terminates the UMA-RLC protocol and inter-works it to the Gb- 
interface using BSSGP. 

[0096] As noted above, the mobile station may be, for example, a wireless phone, 
smart phone, personal digital assistant, or mobile computer. The mobile station may 
also be, for example, a fixed wireless device providing a set of terminal adapter 
functions for connecting Integrated Services Digital Network (ISDN) or Plain Old 
Telephone Service (POTS) terminals to the wireless system. . 
[0097] Other terminal adapter types than those listed above may be employed with 
embodiments of the present invention. For example: (1) a terminal adapter tiiat 
supports cordless telephones rather than POTS phones; (2) a termmal adapter that 
supports standard Session Initiation Protocol (SIP) telephones; and (3) a terminal 
adapter that also integrates a corded handset and user interface, such as one would find 
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on a desk phone. In each case, the invention described herein describes how these 
terminal adapter functions can be connected to the wireless system via the unlicensed 
network. 

[0098] The use of other standard Bluetooth capabilities together with embodiments 
of the present invention is possible. For example, there is a Bluetooth standard 
capability called "SM Access Profile" that allows one Bluetooth device (e.g., an 
embedded cell phone subsystem in a car) to access the SIM that is in another Bluetooth 
device the user's normal cell phone), allowing the first device to take on the 
"personality" associated with the SIM (i.e.y that of the user's normal cell phone). The 
embodiments described above could make use of this standard capability to give the 
terminal adapter-attached devices (e.g., a POTS phone) the personality of the user's cell 
phone. 

MOBILITY MANAGEMENT 
[0099] The UNC 140 provides functions, equivalent to that of a GSM BSC, and as 
such controls one or more (virtual) UMA cells. In one embodiment, there may be a 
single UMA cell per UNC and, in an alternative embodiment, there may be one UMA 
cell per access point connected to a UNC. The latter embodiment may be less desirable 
due to the large number of APs expected to be used, so the UMA architecture permits 
flexible groupings of APs into UMA cells. Each UMA cell may be identified by a cell 
global identifier (CGI), with an unused absolute radio frequency channel number 
(ARFCN) assigned to each UMA cell. Each UMA cell may be mapped to a physical 
boundary by associating it with specific GSM location areas served by the MSC. GSM 
cells within the location areas mapped to a UMA cell are configured with ARFCN-to- 
CGI mappings for that UMA cell. Further, this ARFCN may be advertised in the BA 
list by the GSM cells to permit handovers. Note that UMA cells may use the same 
location area identifiers (LAI) as existing GSM cells, or a new LAI may be used for 
UMA cells. The latter is useful in reducing paging in GSM cells when a mobile station 
is known to be registered via an INC. The above discussion applies equally to GPRS 
routing areas and routing area identifiers (RAIs). 

UMA CPE ADDRESSING 
[00100] Customer premise equipment (CPE) may include the mobile station and the 
access point (AP) through which the mobile station may access the UNC for UMA 
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service. UMA CPE addressing parameters may include the parameters described 
below. 

[00101] The UMA CPE addressing mcludes the international mobile subscriber 
identity (MST) associated with the SIM in the mobile equipment as a parameter. The 
IMSI is provided by the UMA mobile station to the UNC when it requests UMA 
service via the Up interface to the UNC. Unlike the GSM BSC, the UNC manages a 
context for each mobile station that is operating in UMA mode. Therefore, the UNC 
maintains a record for each served mobile station. For example, IMSI may be used by 
the UNC to find the appropriate mobile station record when the UNC receives a 
BSSMAP paging message. 

[00102] The UMA CPE addressing includes the address associated with the 
unlicensed interface in the mobile equipment (e.g.^ 802.11 MAC address) as a 
parameter. This identifier may be provided by the UMA mobile station to the UNC 
when it requests UMA service via the Up interface. The UNC may use this address as 
an alternative to the IMSI to lunit the transfer of the MSI over the Up interface and to 
assist in the routing of messages. 

[00103] The UMA CPE addressing also includes the temporary logical link identifier 
(TLLI) assigned to the mobile station by the serving GPRS support node (SGSN) as a 
parameter. This identifier may be provided via standard Gb-interface procedures. The 
UNC may track this address for each served mobile station to support GSM Gb- 
interface procedures so that downlink GPRS packets may be routed to the correct 
mobile station). 

[00104] The UMA CPE addressing also includes the access point ID (AP-ID) as a 
parameter. The AP-ID may be the MAC address of the xmlicensed mode access point 
through which the mobile station is accessing UMA service. This identifier may be 
provided by the UMA mobile station to the UNC when it requests UMA service via the 
Up interface. The AP-ID may be used by the UNC to support location services 
enhanced 911 service) to the user based on the AP from which the service is being 
accessed. The AP-ID may also be used by the service provider to restrict UMA service 
access only to authorized APs. 

[00105] Other CPE addressing parameters that may be used depend on the security 
requirements of the Up interface (e.g., the need to manage UMA mobile station IP 
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addresses for message routing via tunneled IPSec connections, or the need to manage 
local credentials assigned to the mobile station by the UNC). 

UMA Cell Identification 
[00106] In order to facilitate the mobility management functions in GSM/GPRS, the 
coverage area may be split into logical registration areas called location areas (for 
GSM) and routing areas (for GPRS). Mobile stations may be required to register with 
the network each time the serving location area (or routing area) changes. One or more 
location areas identifiers (LAIs) may be associated with each visited location register 
(VLR) in a carrier's network. Likewise, one or more routing area identifiers (RAIs) 
may be controlled by a single SGSN. 

[00107] In one embodiment, a GSM cell is identified within the location or routing 
area by adding a cell identity (CI) to die location or routmg area identification. The cell 
global identification (CGI) is the concatraation of the location area identification and 
the cell identity. In one embodiment, the cell identity is unique within a location area. 

An Example UMA ^proach to Cell Identification 
[00108] One example of a UMA cell identification approach is described below. In 
this embodiment, a single UNC provides service for one or more UMA location areas 
and one or more UMA routing areas, and each UMA location area (or routing area) is 
distinct from, or the same as, the location area (or routmg area) of the overlapping 
GSM cell. A UMA cell is identified within the UMA location or . routing area by 
adding a cell identity (CI) to the location or routing area identification. The UMA cell 
global identification (UMA-CGI) is the concatenation of the location area identification 
and the cell identity. In one embodiment, a UMA cell may be a pre-defined partition of 
the overaU UMA coverage area identified by a UMA-CGI value. Note that cell 
identification, like UMA information, may be transparent to the AP, such that the AP is 
not aware of its associated UMA-CGI value. The UMA components (e.g,, mobile 
station and UNC) may support the ability to partition the overall UMA coverage area. 
[00109] A partitioning method may include implementing a one-to-one or a many- 
to-one correspondence between GSM cell identity and UMA cell identity. Given the 
identification of a preferred GSM cell in a particular area, it may be possible to 
determine the corresponding UMA cell identity based, for example, on UNC 
provisioning. An example of a one-to-one relationship is mapping a GSM cell to a 
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UMA cell An example of a many-to-one relationship is mapping a GSM location area 
(and associated GSM cells) to a UMA cell. 

[00110] When a UMA mobile station connects to the UNC for UMA service, it 
sends the CGI value and (optionally) a path loss criterion parameter (CI) of the current 
GSM camping cell, as well as the neighbor cells, to the UNC. The UNC maps the 
GSM camping cell's CGI value to a corresponding UMA cell's CGI value based on 
mapping logic provisioned in the UNC, This may be a one-to-one mappiug (eg., if 
there is one UMA cell per GSM cell) or a many-to-one mapping (e-g., if there is one 
UMA cell per GSM location area). If no GSM coverage is available in the UMA 
service area, the UNC may assign the mobile station to a default "no GSM coverage" 
UMA cell. A single UNC may serve one MSC. This does not preclude UNC 
embodiments that combme multiple UNC "instances " as defined above, in a single 
device (for example, a UNC that servers multiple MSCs). Each UNC may also be 
assigned a unique •TJMA-Handover-CGI" value used for GSM-to-UMA handover 
purposes. For example, this may be the value provisioned in the GSM RAN BSC's 
ARFCN-to-CGI tables and m the MSCs (e.g, , to point to the UNC). 

UMA Operating Configurations 
[00111] In one embodiment, at least three UMA operating configurations may be 
identified. In a common core configuration, the UMA LAI and an umbrella GSM RAN 
LAI (e.g., that serves the subscriber's neighborhood) may be different, and the network 
may be engineered such that the same core network entities (eg,, MSC and SGSN) 
serve both the UMA cells and the umbrella GSM cells. One advantage of this, 
configuration is that subscriber movement between the UMA coverage area and the 
GSM coverage area does not result in inter-system (e.g., MAP) signaling (e.g., location 
updates and handovers are intra-MSC), 

[00112] In a separate core configuration, the UMA LAI and umbrella GSM RAN 
LAI are different, and the network may be engineered such that different core network 
entities serve the UMA cells and the umbrella GSM cells. One advantage of this 
configuration is that engineering of the UMA and GSM networks can be more 
independent than in the Common Core Configuration. 

[00113] In a common LAI configuration, the UMA LAI and GSM RAN LAI are the 
same (e.g., different cells within the same LAI). Advantages of this configuration are 
that subscriber movement (while idle) between the UMA coverage area and the GSM 
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coverage area may not result in any location update signaling, and that the mobile 
station can easily switch to GSM mode if UMA mode resources are temporarily 
unavailable (e,g,, to respond to paging). Further details of this and the foregoing 
separate core configuration are discussed in Application Serial No. 10/688,470. 

UMA Registration and Deregistration 
[00114] In one embodiment, as described above, a UMA registration process does 
not employ signaling to the PLMN infrastructure and is contained within the UMA 
system (ue., between tbe mobile station and UNC). The UMA registration process may 
serve at least two purposes. It may inform the UNC that a mobile station is connected 
through a particular AP and is available at a particular IP address. The UNC may keep 
track of this information, for example, for mobile-terminated calling. The registration 
process may also provide the mobile station with the operating parameters associated 
with the UMA service on the AP. This may be analogous to the use of the GSM 
broadcast control channel (BCCH) to transmit system parameters to mobile stations m 
GSM cells. GSM system information message content that is applicable in UMA mode 
may be delivered to the mobile station during the UMA registration process. 
[00115] Similarly, a UMA deregistration process may allow the mobile station to 
explicitly inform the UNC fliat it is leaving UMA mode, allowing the UNC to free 
resources that it may have assigned to the mobile station. The UNC may also support 
implicit UMA deregistration, wherein a secure channel to the mobile station is abruptly 
terminated. 

UMA Redirection 

[00116] In one embodiment, as described above, when a UMA mobile station 
connects to the UNC for UMA service, it may send a CGI value and a path loss 
criterion parameter (CI) of the current GSM camping cell, as well as the neighbor cells, 
to the UNC. Using this information, as well as internal database information, the UNC 
may be able to determine if it is the correct serving UNC for the mobile station, and if it 
is not the correct serving UNC, to redirect the mobile station to the correct UNC. The 
correct serving UNC may be the UNC whose UMA service area overlaps the mobile 
station's umbrella GSM coverage. In one embodmxent, the correct serving UNC mi^t 
be attached to the same MSC as the GSM BSC to which the umbrella GSM cell 
belongs. In an alternative embodiment, the correct serving UNC might be attached to a 
different MSC that may hand-over to the MSC that provides umbrella GSM coverage 
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to the mobile station, allowing the UNC to handover calls to and from GSM. It may 
also enable certain location-based services (e.g., E911 Phase 1) that can be tied to the 
location of the GSM cell. An internal database used by die UNC may map GSM 
location areas to serving UNCs and conserve the amount of data that needs to be 
managed. This database may only need to change when a new UNC or a new GSM 
location area is added. 

[00117] If no GSM coverage is available when a mobile station connects to the UNC 
for UMA service, then, under some instances, the UNC may not reliably determine the 
location of the mobile station for the purposes of assigning the mobile station to the 
correct serving UNC (eg., to enable handover and location-based services). The UNC 
may permit the operator to determine the service policy in this case (e.g., the operator 
may provide service to the user with certain lunitations, possibly with a user interface 
indication on the mobile station). Additional details on UMA registration and 
redirection procedures are provided below. 

UMA Mobile Station Idle Mode Behavior 
[00118] As described above, a UMA device may encounter different radio 
environments as illustrated in Figure 4. In a first environmmt, the GSM and UMA 
coverage areas are completely separate and non-overlapping. In a second environment, 
the GSM and UMA coverage is partially overlapping. In a third environment, which 
may be the most common, the UMA coverage is encapsulated within the GSM 
coverage. A UMA device may power on in any of these environments and further may 
transition in a number of attached states. 

[00119] At power on, and when the mobile station is idle and there is no coverage of 
any type, the mobile station may scan for both GSM and UMA radio coverage. If GSM 
coverage is detected, then the normal GSM mobility management procedure may be 
initiated. This condition may apply when no UMA coverage has been detected by the 
mobile station when GSM coverage is detected, or prior to the completion of the UMA 
registration process. If UMA coverage is detected, then the UMA mobile station 
establishes an unlicensed wureless Imk WLAN link) to the AP and monitors signal 
quality. When the received signal level at the mobile station passes a predefined 
threshold, the mobile station performs the UMA registration procedure. Based upon 
the information returned, the mobile station may determine if a fiill network registration 
is required, and if so, what type (e.g., GSM or combined GSM/GPRS). This procedure 
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may apply when no GSM coverage exists or when UMA coverage is detected prior to 
detecting GSM coverage. 

[00120] When the mobile station is idle in GSM coverage, and diere is no UMA 
coverage, the mobile station may periodically scan for UMA coverage. If UMA 
coverage is detected, the mobile station may initiate the UMA registration procedure 
described above. 

[00121] When the mobile station is idle in UMA coverage and there is no GSM 
coverage, the mobile station may continue to perform normal GSM PLMN search 
procedures. If GSM coverage is detected, the mobile station may send the GSM cell 
information to the UNC for possible UMA redirection purposes as described above. 
Alternatively, the mobile station may disable normal GSM PLMN search procedures to 
conserve power. 

[00122] When the mobile station is idle in UMA coverage, and there is GSM 
coverage, the mobile station may continue to perform normal GSM cell reselection 
procedures and may store the identification of the selected GSM cell to speed the 
transition to GSM mode, if requked. Alternatively, the mobile station may disable 
normal GSM cell reselection procedures to conserve power. 

[00123] At power off m UMA coverage, a detach indication may be sent by the 
mobUe station to the PLMN via the UMAN (e.g., if required by the PLMN network or 
normally sent by the mobile station at power off). This indication may be encoded per 
the current GSM mode of operation (e.g., GSM or GPRS). 

[00124] The UMA environment may be an BEEE 802.11 environment. In this case, 
the mobile station periodically performs an active scan for available 802.11 APs. When 
an AP is discovered, it may be matched against a stored profile of user preferences and 
security credentials, in which case the mobile station may automatically associate with 
the AP. The mobile station may enter low-power sleep mode, waking up periodically 
to measure signal quality for determining when to trigger UMA registration. 
[00125] The UMA ^vironment may be a Bluetooth environment. In this case, the 
mobile station previously paired with the Bluetooth AP through whidi it will access 
UMA service. Periodically, the mobile station may enter a page scan receive mode, 
and respond to an AP transmit page to establish a link-level connection. Once a link- 
level control channel is established, and if the mobile station is not otherwise active, it 
may enter a low-power Bluetooth state park mode) to conserve power. 
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Periodically, the AP may poll the mobile station to allow it to re-enter active-power 
mode. This periodic traffic may also be used by the mobile station to measure signal 
quality to determine when to perform the UMA registration procedure. 

UMA Mobile Station Dedicated Mode Behavior 
[00126] A UMA device engaged m a voice call, a data transaction or a shnultaneous 
voice/data transaction may encounter a transition from GSM coverage to UMA 
coverage or a transition from UMA coverage to GSM coverage. In one embodunent, 
when the coverage transitions from GSM to UMA coverage, calls may be handed over 
transparently between the GSM RAN and tiie UMAN. In the case of voice, the 
handover may be accomplished by a handover function. In the case of data, session 
management controls may provide a common end-user experience to that provided in 
GPRS. Normal registration actions may occur upon a return to the idle state, if 
appropriate. When the coverage transitions from UMA to GSM coverage, calls may be 
handed over transparently between the UMAN and the GSM RAN, In the case of 
voice, the handover may be accomplished by a handover function. In the case of data, 
session management controls may provide a common end-user experience to that 
provided in GPRS. 

Summary of Key Mobility Management Concepts 
[00127] Figure 5 illustrates mobility management functions in one example 
embodiment. In Figure 5, unlicensed network controller UNC-1 is the serving UNC for 
the UMA cells associated with GSM location areas LA-11 to LA-23. UNC-1 maps 
GSM location areas LA-lx to UMA cell UMA CGMOl and GSM location areas LA- 
2x to UMA CGM02. Unlicensed network controller UNC-3 is the serving UNC for 
the UMA cells associated widi GSM location areas LA-31 to LA-33. UNC-3 maps 
GSM location areas LA-3x to UMA cell UMA CGI-301. Mobile station MS-1 will be 
in UMA cell UMA-CGI-101 (since GSM LA-lx is mapped to UMA-CGI-101). 
Mobile station MS-2 wiU be in UMA cell UMA-CGI-102 (since GSM LA-2x mapped 
to UMA-CGI-102). Mobile station MS-3 will be in UMA cell UMA-CGI-301 (since 
GSM LA-3X mapped to UMA-CGI-301). If mobile station MS-4 connects to UNC-1, 
it will be in UMA cell UMA-CGI-199 (no GSM coverage). If MS-4 connects to UNC- 
3, it will be in UMA cell UMA-CGI-399 (no GSM coverage). Mobile stations MS-1 
and MS-2 may connect to UNC-1 without redirection. If mobile station MS-3 attempts 
to connect to UNC-1, it may be redirected to UNC-3. 
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UMA Radio Resource (URR) Messaging and Message Formats 
[00128] In accordance with aspects of the present invention, details of UMA Radio 
Resource (URR) messaging and correspondmg message formats to support and manage 
mobility of mobile stations are now disclosed. The particular format of each message 
is exemplary, and the formats are merely illustrative of information elements that 
should and/or may be included in a particular implementation, with some of the 
information elements being optional. 

[00129] The UMA-RR messages are conveyed over the Up interface using the TCP 
connection. The UMA-RR message format follows the standard GSM layer 3 message 
structure defined in GSM04.07. Each message consists of the following elements: 

1 . UMA'RR protocol discriminator - to ease the interworkmg with the GSM RR 
protocol, in one embodiment the UMA-RR protocol reuses the same protocol 
discriminator as the GSM RR, which is the binary sequence of 01 10 for bits 3 to 
0 of the first octet of every UMA-RR message. It is noted that this is merely 
exemplary, as other sequences may be used, depending on the particular 
implementation. 

2. Skip Indicator- Jn one embodiment, Bits 5 to 8 of the first octet of every UMA- 
RR message contains the skip indicator. An UMA-RR message received with 
skip indicator other than 0000 shall be ignored. The UMA-RR entity shall 
always encode the skip indicator as 0000. 

3. Message Type - the message type IE (information element) and its use are 
defined in GSM04.07. The UMA-RR message types for one embodiment are 
listed in Table 1 below. 

4. UMA-RR Connection Indicator (UCI) - The UCI is used to explicitly indicate 
the first message on the UMA-RR connection, versus subsequent messages on 
the connection. This allows the MS and the UNC to synchronize thek respective 
UMA-RR connection states. 

i. The MS normally sets UCI to the value * 1' to indicate that the message 
is the first on the new UMA-RR connection. 
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ii. However, if the UMA connection is for an emergency call, the MS sets 
UCI to the value *9'. This allows the UNC to give priority to emergency 
call-related UMA-RR connection requests. 

iii. For all other messages associated with the UMA-RR connection, the MS 
sets UCI to the value *0' . 

iv. For example, if the MM sublayer in the MS requests a new UMA-RR 
connection and then sends a CM-SERVICE-REQUEST message, the 
UMA-RR entity in the MS sets UCI=L If the MM sublayer reuses an 
existing UMA-RR connection to send the CM-SERVICE-REQUEST 
message, the UMA-RR entity in the MS sets UCI=0. The UCI is used to 
indicate the implicit allocation of resources for a UMA-RR session, 

5. Other information elements, as required. 

i. The Presence column indicates whether an information element is 
mandatory C*M"), optional ("O") or conditionally present ("C"). 

ii. The Format column indicates how the IE is formatted: "TLV" for tag- 
length-value format, "LV" for length-value and "V" for value only. The 
tag for the IE is also referred to as the Information Element Identifier 
(BSI). Mandatory information elements use "V" or "LV" format, 
depending on whether they are fixed or variable length. Optional and 
conditional mformation elements always use "TLV" format. 

5. Length Indicator, In one embodiment, a separate Length Indicator IE is used to 
specify the length of ai given message. In another embodiment, the underlying 
transport layer is used to provide a length indication for each message. 
Accordingly, a separate Length Indicator IE is not included in this message 
format. Both types of formats are illustrated by the URR messages disclosed 
herein. 



MESSAGE NAME 


MESSAGE TYPE 


URR REGISTER REQUEST 


0011 0011 (0x33) 
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MESSAGE NAME 


MESSAGE TYPE 


URR REGISTER ACK 


00110110(0x36) 


URR REGISTER REJECT 


00110111 (0x37) 


URR ACnVATB CHANNEL 


0010 1110 (0x2E) 


URR ACTIVATE CHANNEL ACK 


0010 1001 (0x29) 


URR ACTIVATE CHANNEL FAILURE 


00101111 (0x2F) 


URR ACTIVATE CHANNEL COMPLETE 


0010 1010 (0x2A) 


URR HANDOVER REQUIRED 


0001 0001 (0x11) 


URR HANDOVER COMMAND 


0010 1011(0x23) 


URR HANDOVER COMPLETE 


00101100(0x20 


URR HANDOVER FAILURE 


0010 1000 (0x28) 


URR HANDOVER ACCESS 


0010 1101 (0x2D) 


URRRRRELEASE 


00001101 (OxOD) 


URR RR RELEASE COMPLETE 


0000 1111 (OxOF) 


URR PAGING REQUEST 


00100001(0x21) 


URR PAGING RESPONSE 


00100111(0x27) 


URR CLASSMARK CHANGE 


0001 0110(0x16) 


URR CLASSMARK ENQUIRY 


0001 0011 (0x13) 


URR RR CLEAR REQUEST 


0011 nil (Ox3F) 


URRDEREGISTER 


0011 1011 (Ox3B) 


URR UPLINK QUALITY INDICATION 


0010 0110(0x26) 


URR REGISTER UPDATE UPLINK 


0011 1100(0x30 


URR REGISTER UPDATE DOWNLINK 


0011 1101 (0;^3D) 



TABLE 1 

Registration Messages and Messages Formats 
[00130] Figures 6A-C show examples of sequences of messages that are passed 
between an MS and a UNC (via an AP connected therebetween) under various 

28 



wo 2005/114918 



PCT/US2005/016767 



registration scenarios. Messages and associated signals passing between the different 
elements are shown as horizontal arrows with arrowheads connecting the elements of 
the communication systems that are involved. When the arrow passes across an 
element and no arrowhead is shown, then this element functions as a pass through. The 
particular elements of the system architecture of Figure 1 that are involved m Figures 
6A-C are, from left to right, a mobile station (e.g. MS 102), an access point ie.g., 
WLAN AP 128), a &st UNC (eg., UNC-1 (UNC 140A)) and a second UNC (e.g., 
UNC-2(UNC 140B)). 

[00131] Prior to the registration process, various operations are performed to 
establish a connection with between MS 102 and AP 128, and then to establish a 
connection between MS 102 and UNC 140. At step A of Figure 6A, the MS 102 comes 
into the coverage range of AP 128 and establishes a wireless link with the AP. For 
example, this wireless link may be a WLAN connection using unlicrased frequencies 
under the IEEE 802.11 or Bluetootihi protocols. At step B, the MS looks for a UNC to 
establish a connection with. This may be done by performing a DNS (Domain Name 
System) query for a UNC. This initiates a connection to the first UNC's IP address. 
The MS may select the first UNC because it is the last UNC IP address that it used or it 
may be a default UNC or it may be a home UNC that the MS is assigned to for initial 
registrations, or it may be selected from a cache of connected UNCs indexed by the AP 
and CGI. At step C, the UNC and the MS establish a secure TCP connection. Note 
that IPSec security procedures between the MS and UNC are not shown in Figures 6A- 
C. 

[00132] At step D, the MS sends a request for registration embodied as a UMA 
URR-REGISTER REQUEST message 600 to the UNC. One embodiment of an URR 
REGISTER REQUEST message 600 is shown in Figure 7. For illustrative purposes, 
each message format illustrated herein includes an BBI (Information Element Identifier) 
colmnn, an Information Element column, a Type/Reference column, a Presence 
column, a Format column, a Length Column, and a Value column. It is noted that the 
actual messages will include a value that identifies the message type, along with 
appropriate IE values in accordance with each particular message format. Also, as with 
each of the messages discussed herein, URR REGISTER REQUEST message 600 
includes a UMA RR protocol Discriminator IE, a Slap Indicator IE, a Message Type IE 
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(URR REGISTER REQUEST in this instance), and UCI IE. As used herein, these four 
lEs are referred to as "basic" lEs to indicate they are included in each message format. 
[00133] In addition to the basic lEs, URR REGISTER REQUEST message 600 
includes a mobile identity IE, a GSM RR State IE, a GPRS Class Capability IE, a Cell 
Identifier List IE, a CI List IE, an AP Identifier IE, and an AP Location E. The mobile 
identity IE is mandatory and uses IMSI or EMEI if MSI is not avaUable. The GSM RR 
State IE is included to indicate the current GSM RR entity state. The GPRS Class 
Capability IE is included to uidicate the GPRS Class capabUity of the MS. The Cell 
Identifier List IE is included if valid GSM cell information is available to the UMA RR 
entity. Within this DB, the Cell Identification Discriminator field shall be 0000 
indicating the Cell Global Identification (CGI) format is used to identify the cells. The 
CI List IE is present only if the "cell identifier list" IE is present. It contains the path 
loss criterion parameter CI of each ceU in the "CeU Identifier List" IE. The AP 
Identifier IE contains the MAC address of the unlicensed interface of the AP through 
which the MS is registering with the UNC. If the AP location is available, the MS can 
send corresponding mformation identifying the location of the AP via the AP Location 
IE, such as street address, latitude and longitude, etc. In addition to the foregoing 
registration content, the URR REGISTER REQUEST message may further include a 
reason for the connection and information about transmitting base stations that are 
within range (not shown). 

[00134] In a GSM system, this information is labeled Cell-Info and includes CGI 
and (optionally) CI values. In one embodiment, only a single CGI is reported by the 
MS, representing the GSM cell that the MS has selected usmg its normal GSM cell 
selection procedures. This single cell has been selected by the MS to be the "best" 
GSM cell. Typically, to develop such values, the MS will scan certain designated 
fiequencies to find broadcast channel (BCH) transmissions. The BCH will identify the 
transmitting base station and contain mformation about random access and traffic 
channels that are used by the particular base station. The MS can record the base 
station identities and measure the quality of the BCH signal as it is received. In GSM 
systems, the RXLEV (Received Signal Uvel) is typicaUy measured but other quality 
measures may be used instead of, or in addition to the RXLEV. including signal to 
noise ratios, bit error rates, RSSI (Received Signal Strength Indicator) and signal 
propagation delays. 
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[00135] The UNC evaluates the received infonnation about location and selects the 
appropriate UNC for the MS. This selection may be maintained for as long as the MS 
remains connected to the same AP. As mentioned above, there are a variety of 
different ways to select the appropriate UNC. In one embodiment the UNC maps the 
identification of the AP to a location, to a corresponding MSG and then to a 
corresponding UNC. In yet another embodiment, the UNC has no location information 
about base stations or the AP but it has a prior registration from the AP that included 
location information and selects a UNC on that basis. 

[00136] In the simplest case, the registration request will be honored by the UNC to 
which it was submitted by having that UNC return a URR REGISTRATION 
ACK(nowledgement) message 602. Optionally, the message is referred to as a URR 
REGISTRATION ACCEPT message. One embodiment of a URR REGISTRATION 
ACK message 602 is shown in Figure 8A. 

[00137] The information elements of URR REGISTRATION ACK message 602 
includes the basic IBs (e.g., Protocol Discriminator, Skip Indicator, Message Type, and 
UCI), as well as a UMA System IrformaHon IE, a GPRS Uplink IP address, a GPRS 
Uplink UDP port, an Up Parameter Configuration IE, and a Status IE. Details of the 
formatting of one embodunent of the UMA System Information IE are shown m Figure 
8B. Details of the various fields shown in the UMA System Information IE of Figure 
8B are shown below. 

GLIR - GSM Location Information Request 

0 GSM location information not requested 

1 GSM location information requested 

ATT - Attach/detach allowed 

0 IMSI attach/detach not allowed in UMA cell 

1 MSs in the UMA cell shall apply IMSI attach and detach procedure 

TI804 - Timer value 
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000 0 second, /.e, immediate access mode switching upon receipt of 
UMA-LINK-DETACH message or link loss 

001 5 seconds 

010 10 seconds 

011 15 seconds 

100 20 seconds 

101 25 seconds 

110 30 seconds 

111 35 seconds 



UMA-CELL-RESELECT-HYSTERESIS 



000 


OdB RxLev hysteresis 


001 


2dB RxLev hysteresis 


010 


4dB RxLev hysteresis 


oil 


6dB RxLev hysteresis 


100 


8dB RxLev hysteresis 


101 


lOdB RxLev hysteresis 


110 


12dB RxLev hysteresis 


111 


14dB RxLev hysteresis 



T3212 - Periodic Location Update timer 

The T3212 timout value field is coded as the binary representation of the 
timeout value for periodic updating in decihours. 
Range: 1 to 255 

The value 0 is used for infinite timeout value, Le. periodic updating shall 
not be used within the UMA cell 



EC - Emergency Call Allowed 

0 Emergency call allowed in the UMA cell to all MSs 
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1 Emergency call not allowed in the UMA cell except for the MSs that 
belong to one of the classes between 11 to 15 

ACCN - Access Control Class N 

For a MS with AC C = N access is not barred if the AC CN bit is coded 
witha*0';N = 0.1,..,9, ..,15 

TI 81 1 - UMA Channel Activation timer 

The TI 811 value field is coded as the binary representation of the timeout 

value in 100ms resolution. 

Range: 1 - 255 (100 ms to 25.5 sec) 

TI 900 - GSM to URR HANDOVER supervision timer 

The TI 900 value field is coded as the binary representation of the timeout 

value m 100ms. resolution. 

Range: 11 255 (1,1 sec to 25.5 sec) 

UMA-BAND 



0000 


P-GSM900 


0001 


E-GSM900 


0010 


R-GSM900 


0011 


DCS 1800 


0100 


PCS 1900 


0101 


GSM 450 


0110 


GSM 480 


0111 


GSM 850 



All other values are reserved 
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ECSM - Early Classmark Sending Mode, control the "early classmark sending" 
behavior 

0 Hold the URRCIASSMARK CHANGE Diessage until the first 
downlink message is received 

1 Send the URR CLASSMARK CHANGE message as early as possible 
after XJMA RR connection is established 

GPRS Ihd - GPRS Service Availability 

0 GPRS service not available in the UMA cell 

1 GPRS service supported in the UMA cell 



UMA-GPRS-CELL-RESELECT-HYSTERESIS 


000 


OdB RxLev hysteresis 


001 


2dB RxLev hysteresis 


010 


4dB RxLev hysteresis 


oil 


6dB RxLev hysteresis 


100 


8dB RxLev hysteresis 


101 


lOdB RxLev hysteresis 


no 


12dB RxLev hysteresis 


111 


14dB RxLev hysteresis 



NMO - Network Mode of Operation. This field is meaningfiil only if "GPRS 
Ind" flag is set to 1 

00 Network Mode of Operation I 

01 Network Mode of Operation n 

10 Network Mode of Operation m 

11 Reserved 
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UMA-RAC - Routing Area Code of the UMA cell, see GSM03.03. This field is 
meaningful only if "GPRS Ind" flag is set to 1 

[00138] The Up Parameter Configuration BE enables a UNC to configure Up 
interface parameters such as timers, retry coimters, etc. The Status DE provides an 
indication from the UNC on whetiier location services are available (based on 
knowledge of AP's geographical location). This can be used to triggo: an icon or other 
display on the MS. In one embodiment the possible values are: 

0 Location Services are Available 

1 Location Services are Not Available 

[00139] If the network decides to reject the registration from the MS, the UNC will 
return an URR REGISTER REJECT message 604 to the MS, as depicted in the 
message sequence shown in Figure 6B. The format for one embodiment of URR 
REGISTER REJECT message 604 is shown in Figure 9. In addition to the basic lEs, 
this message includes a UMA RR Cause IE, and optional Redirected UNC Address DE 
and Redirected SGW (Security Gateway) Address lEs. The RR Cause IE contains a 
value that is used to specify a reason for the rejection, such as Network Congestion, AP 
not allowed, Location not allowed, IMSI not allowed, etc. 

[00140] The optional Redirected UNC Address DB and Redirected SGW Address JEs 
may be employed for redirection purposes. For example, a registration message 
sequence that involves UNC redirection is shown in Figure 6C. Redhrection may be 
applicable under various circumstances. For example, the location of a given AP might 
be moved, such that it is more advantageous to access the network via another AP. 
Similarly, an MS may contain information instructing it to access a default UNC based 
on a "normal" location of a subscriber - if the subscriber location is different, the 
default UNC may not be appropriate. 

[00141] Referring to Figure 6C, at step E a determination to redirect the session to 

UNC 2 is made by the serving UNC {e.g., UNC 1) and/or the network in view of 

applicable criteria as described above. At step F, UNC 1 acknowledges the registration 

request and sends a URR REGISTER REJECT message 604A that contains an address 

for the selected UNC (UNC 2) and/or the address for the security gateway associated 

with the UNC to MS 102. The address(es) may be in the form of a FQDN (Fully 

Qualified Domain Name) or in another form, such as an IP address. In another 
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embodiment, a separate URR REGISTER REDIRECT message is used (not shown). 
Under this embodiment (separate URR REGISTER REJECT and URR REGISTER 
REDIRECT messages), the URR REGISTER REJECT message does not contain any 
redirection EEs. 

[00142] At step G, the MS performs a DNS query for the selected UNC. It may also 
release the TCP connection to the first UNC (UNC 1) and mitiate a connection to the 
second UNC's BP address or SGW address. Accordingly, at step H, a TCP connection 
is established between the MS and the new UNC (UNC 2) to which the MS was 
redirected. At step H, the connection is established between the MS and the second 
UNC. The IPSec tunnel with the original UNC may be reused or a new one may be 
established (not shown). 

[00143] At step I, the MS may send a second registration request message to the 
second UNC, as depicted by a URR REGISTER REQUEST message 600A. In a URR- 
REGISTER-REQUEST type of message, a reason field may carry a value for 
redirection instead of a normal connection. The information in the registration request 
may caxise the new UNC to apply information that it has to further redirect the MS. 
Because it is closer to the location of the AP, it may have more or better information on 
the AP, nearby base stations or network resource allocations and may then further 
redirect the MS, The reason field may be used to inform the MS about the number of 
redirections. It may be used to limit the total number of redirections that a MS may 
experience at a single AP to one or two or any other number. 

[00144] At step J, the connection with the UNC continues along its normal course. 
This may include registration acknowledgments, call setup and teardown, and any of a 
variety of different supported voice or data services, including security measures. 

Registration Update 

[00145] Under various use scenarios, a need to perform a registration update may 
result. Generally, a registration update procedure may be initiated by an MS (more 
common) or the network (less conunon). For example, after an MS has successfully 
registered to an UNC, the MS may employ a registration update procedure to inform 
the UNC if the AP (via which the MS is accessing the network) or the overlapping 
GSM coverage has changed. 

[00146] An example of messaging employed to facilitate an MS-initiated registration 
update is shown in Figure IDA. At step A, MS 102 has established a connection with 
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UNC 140 in the normal manner described above. At step B, the MS obtains valid cell 
information. For example, the MS receives information for a local GSM cell. At step 
C, the MS sends a URR REGISTER UPDATE UPLINK message 1000 to the UNC. 
The URR REGISTER UPDATE UPLINK message is sent by an MS to a UNC to 
update registration parameters. 

[00147] Figure 11 shows one embodiment of URR REGISTER UPDATE UPLINK 
message 1000. In addition to the basic lE's, this message includes a Reason IE, a Cell 
Identifier List IE, a CI List IE, an AP identifier IE, and an AP Location EE. The Reason 
IE is a mandatory IE that specifies whether the reason for the update is due to a cell 
update or an AP update. A Cell Identifier List JE will be included if GSM cell 
information (available to the UMA RR entity) has changed since the last registration or 
update. Within this IE, the Cell Identification Discriminator field shall be 0000 
indicating the Cell Global Identification (CGI) format is used to identify the cells. The 
CI List JE is present only if the Cell Identifier List BE is present. It contains the path 
loss criterion parameter CI of each cell in flie Cell Identifier List IE. The AP Identifier 
IE will be included if the AP through which the MS is conununicating with the UNC 
has changed since the last registration or update. The AP Identifier is the MAC address 
of the unlicensed interface of the AP through which the MS is communicating with 
UNC. 

[00148] When receiving a URR REGISTER UPDATE UPLINK message, the 
network may either accept or reject the registration update, or redirect the MS to 
another UNC. In one embodiment, if there are not any actions to be taken by the UNC 
(e.g., a change in the access elements for the MS), the UNC simply accepts the 
registration update parameters with no reply message. In this case, the URR 
REGISTER UPDATE UPLINK message is merely informative. If the network rejects 
the registration update, the network sends a URR DEREGISTER message to the MS. 
Details of a URR DEREGISTER message are discussed below. Additionally, 
depending on the registration update information that is sent m the message, the UNC 
may redirect the MS to another MS using a URR REGISTER REDIRECT message, as 
depicted by a URR REGISTER REDIRECT message 604A at step D in Figure lOA. In 
response, normal connection procedures would be established with the new UNC to 
which the MS was redu:ected, as shown m a step E. 
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[00149] Figure lOB shows various message transfers that may be performed in 
connection with a network-initiated registration update. As before, at step A MS 102 
has established a connection with UNC 140 in the normal manner. At step B, a 
network-initiated update event occurs. At step C, the UNC sends a URR REGISTER 
UPDATE DOY/NLINK message 1002, one embodunent of which is detailed in 
Figure 12. The URR REGISTER UPDATE DOWNLINK message 1002 includes a 
Redirected UNC Address IE, a Redirected SGW Address IE, and a Status IE. The 
Status BE provides an indication from the UNC on whether location services are 
available (based on knowledge of the AP*s geographical location). This can be used to 
trigger an icon or other display on the MS. Possible values are: 

0 Location Services are Available 

1 Location Services are Not Available 

[00150] Under some conditions, it may be advantageous to have an MS be redirected 
to re-register with a different UNC in view of the updated registration information, ff 
the network decides to redirect the MS to another UNC, it will send a URR REGISTER . 
REDIRECT message to the MS, as depicted bjj a URR Register Redirect message 604B 
at step D. At step E, normal connection procedures are performed to establish a 
connection with the UNC to which the MS is redirected. 

Deregistration 

[00151] In general, deregistration may be mitiated by an MS (eg., when 
deregistering an existing connection) or the network via an appropriate UNC. For 
instance, the MS should attempt to perform a deregister procedure before leaving an 
AP, which is facilitated by sending a URR DEREGISTER message from the MS to the 
UNC. Sunilarly, the UNC may initiate deregistration of the MS at any time by sending 
a URR DEREGISTER message to the MS. 

[00152] An exemplary URR DEREGISTER message format 1300 is shown in 
Figure 13, which includes a URR cause IE in addition to the basic lEs. A lookup table 
containmg an exemplary set of values for the URR cause IE are shown m Figure 14. 
Based on the URR cause value, a lookup into the URR cause lookup table may be 
performed to identify the reason for the deregistration 

Channel Activation 
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[00153] Channel activation is used to establish a voice or circuit switched data 
bearer channel Figure 15 shows an exemplary message sequence performed in 
connection with channel activation. At step A, MS 102 has established a connection 
with UNC 140 in the normal manner. At step B, the UNC sends an URR ACTIVATE 
CHANNEL message 1500 to the MS. In response to receiving a URR ACTIVATE 
CHANNEL message, the MS attempts to establish a corresponding UMA voice bearer 
channel. If successful, the MS returns a URR ACTIVATE CHANNEL 
ACK(nowledge) message 1502, as shown at step C. If the UMA voice bearer channel 
cannot be established, the MS returns a URR ACTIVATE CHANNEL FAILURE 
message 1504, as shown at step C\ Upon successful activation, a URR ACTIVATE 
CHANNEL COMPLETE message 1506 is sent by the UNC to the MS to indicate that 
the established voice channel between the MS and the UNC is now ready for use, as 
shown at step D. 

[00154] Figure 16 shows details of one embodmient of a URR ACTIVATE 
CHANNEL message. In addition to the basic DBs, this message includes a Channel 
Mode DE, a UNC SDP IE, and a CIPHER Mode Setting IE. In one embodunent, the 
Channel Mode JE specifies the following channel modes: 

0000 0001 speech full rate or half rate version 1 
0010 0001 speech full rate or half rate version 2 
0100 0001 speech full rate or half rate version 3 (AMR version 1) 
[00155] The UNC SDP (Session Description Protocol) IE is used for specifying 
information used to implement the uplink (from MS to UNC) portion of the voice 
bearer channel. For example, this information may include the network address (BP 
address), the transport address (port), the transport protocol (eg., RTF over UDP), the 
sample size (e.g., 20 ms) and the payload type (among other things). In one 
embodiment the format of this lE's values are defined in RFCs 2327, 3551 and 3267. 
The use of a single IE to contain this information is merely exemplary, as such 
information may also be provided via separate lEs. The optional CIPHER Mode 
Setting IE appears when the ciphering mode is dianged after the MS has switched to 
the assigned channel. If this information element is omitted, the mode of ciphering is 
not changed after the channel assignment procedure. 
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[00156] Figure 17 shows one embodiment of a URR ACTIVATE CHANNEL ACK 
message. In addition to the basic lEs, this message format includes an MS SDP BE, an 
optional Cell Identifier List IE, and a conditional CI list IE. The MS SDP IE is used for 
specifying information used to implement the downlink (from UNC to MS) portion of 
the voice bearer channel. This IE is substantially analogous to the UNC SDP IE 
discussed above, except that the port and address information now pertains to the MS 
rather than the UNC. The Cell Identifier List IE will be included if valid GSM cell 
information is available to the UMA RR entity. Within this IE, the Cell Identification 
Discriminator field is set to 0000 to indicate the Cell Global Identification (CGI) format 
is used to identify the cells. The CI List IE is present only if the Cell Identifier List IE 
is present. It contains the path loss criterion parameter CI of each cell in the Cell 
Identifier List IE. 

[00157] Figure 18 shows one embodiment of a URR ACTIVATE CHANNEL 
FAILURE message. The additional lEs include a UMA RR Cause IE, an optional Cell 
Identifier List IE, and a conditional CI List IE. The UMA RR Cause IE contains a 
coded cause of the failure. Meanwhile, the Cell Identifier List IE and a conditional CI 
list IE are the same as above. 

[00158] Figure 19 shows one embodiment of a URR ACTIVATE CHANNEL 
COMPLETE message. As depicted, this message format only contains the basic lEs, 
wherein the message is identified by its Message Type value. 

Handovers 

[00159] There are two primary types of handovers supported by the network: 
Handover to UMAN, arid handover from UMAN. During a handover to UMAN, 
network access to an MS is handed over from licensed-based radio access network 
ie,g., GERAN) to UMAN network infrastmcture. During a handover from UMAN, the 
MS access is handed over from the UMAN network infrastructure to the licensed-based 
radio access network. 

Handover to .UMAN 

[00160] An exemplary message sequence corresponding to a handover to UMAN is 
shown in Figure 20. Step A rq)resents an existing coimection that has previously been 
established, such as by using the technique shoAvn in Figure 6A. At step B, a URR 
HANDOVER ACCESS message 2000 is sent from MS 102 to UNC 140 in response to 
a correspondmg handover order made by the licensed network. If non-signaling mode 
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is indicated in the Channel Mode IE, the UNC initiates Traffic channel assignment, as 
depicted at step C. If the traffic channel assignment is successful, the MS will return a 
URR HANDOVER COMPLETE message 2002 to the UNC, as depicted at step D. 
[00161] One embodiment of a URR HANDOVER ACCESS message is shown in 
Figure 21. In addition to the basic lEs, this message format includes a HANDOVER 
COMMAND message BE. This IE contains the complete HANDOVER COMMAND 
layer 3 message (as described below) to provide handover reference used by the UMA 
Controller for access identification. 

[00162] Figure 22 shows one embodiment of a URR HANDOVER COMPLETE 
message. The message format includes the basic lEs, and is identified by the value of 
the message type. 

Handover from UMAN 
[00163] A handover from the UMAN is performed to transfer a connection between 
an MS and the UMAN to another radio access network (e.g., GERAN). Message 
sequences corresponding to successful and unsuccessful handovers from UMAN are 
respectively shown in Figures 23A and 23B. The handover from UMAN procedure 
begins with a connection established and the MS in a dedicated state, as shown at step 
A. In response to a URR UPLINK QUALITY INDICATION message 2300 received 
from the UNC at step B, or if the MS determines a handover is appropriate, the MS 
sends a URR HANDOVER REQUIRED message 2302 to the UNC at step C. The 
UNC then sends a URR HANDOVER COMMAND 2304 back to the MS at step D. If 
the handover from UMAN is unsuccessful, the MS returns a URR HANDOVER 
FAILURE message 2306, as shown at step E in Figure 23B. 

[00164] Details of one embodiment of a URR UPLINK QUALITY INDICATION 
message are shown in Figure 24. The message may include various information 
indicative of uplink quality of the bearer channel. The particular format of this 
information is dependent on the particular implementation. 

[00165] Figure 25 shows details of one embodiment of a URR HANDOVER 
REQUIRED message. In addition to the standard IBs, this message mcludes a Channel 
Mode IE, and Cell Identifier List, and a CI List. These latter two IBs are the same as 
discussed above. In one embodiment, the Channel Mode IE defines the chaimel mode 
as specified by GSM04.08. 
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[00166] Figures 26A and 26B show details of one embodiment of a URJR 
HANDOVER COMMAND message. This message format is compiled based on the 
HANDOVER COMMAND message format defined in GSM 04.08/Release 98, with all 
optional lEs not applicable to the UMA to GSM handover removed. This message 
format includes a number of EEs in addition to the basic lEs; selected lEs are detailed 
below. 

[00167] The Synchronization Indication IE is used to identify what type of 
synchronization is applicable. If this information element does not appear, the assumed 
value is "non-synchronized". Four types of handover defined in section 3.4.4.2 of 
GSM04.08: Non-synchronized, Synchronized, Pre-synchronized, and Pseudo- 
synchronized. The UMA to GSM handover can be either a non-synchronized or pre- 
synchronized handover. Synchronized handover and pseudo-synchronized handover 
require the MS to calculate the timing advance based on known one way delay with the 
old BTS and the Observed Time Difference between the old and new BTS (more 
description in aimex A of GSM05.10). For a UMA to GSM handover, such variables 
are imknown. The ROT field of this IE shall be set to 0 so that the MS does not need to 
report its Observed Time Difference in the HANDOVER COMPLETE message. 
[00168] Mode of the First Channel IE: If this information element is not present, the 
channel mode of the previously allocated channel shall be assumed. 
[00169] Frequency Channel Sequence, Frequency List, Frequency short list and 
Mobile Allocation, after time lEs: If at least one of die channel descriptions for after 
time indicates frequency hopping, one of the following information elements will be 
present: 

Frequency Channel Sequence, after time; 

Frequency list, cfier time; 

Frequency Short List, after time; 

Mobile Allocation, after time: 
[00170] If neither of the Channel Description BBs indicate frequency hopping, if they 
are not required for the decodmg of Channel Description DSs for before tune, and if any 
of the four information elements are present, they will be considered as lEs umecessary 
in the message. 
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[00171] The Frequency Channel Sequence EE shall not be used unless all the 
ARFCNs that it indicates are in the P-GSM band. The starting time IE is included 
when the network wants the MS to change the frequency parameters of the channels 
more or less at the moment a change of channel occurs. In this case a number of 
information elements may be included to give the frequency parameters to be used 
before the starting time. The starting time IE refers to the new cell time. If the starting 
time IE is present and none of the information elements referring to before the starting 
time are present, the MS waits and accesses the channels at the indicated time. If the 
starting time DE is present and at least one of the information elements referring to 
before the starting tune is present, the MS does not wait for the indicated time and 
accesses the channel using the frequency parameters for before the starting tune. If the 
starting time IE is not present and some of the information elements referring to before 
the starting time are present, these information elements shall be considered as lEs 
unnecessary in the message. 

[00172] If the description of the first channel, before time IE is not present, the 
channel description to apply for before the tune, if needed, is given by the description 
of the first channel, after time BE. If the description of the second cJianneU after time DE 
is present, the description of the second channel before time IE not present, and a 
description of the configuration for before the time needed, the channel configuration 
before the starting tune is nevertheless of two traffic channels, and the chaimel 
description to apply to the second channel before the starting time is given by the 
description of the second channel, after time IE. 

[00173] If the starting time DE is present and at least one of the channel descriptions 
for before the starting time indicates frequency hopping, one and only one of the 
following information elements may be present and applies before the starting time to 
all assigned channels: 

Mobile Allocation, b^ore time IE; 

Frequency Short list, before time IE; 

Frequency list, before time IE; 

Frequency channel sequeme, before time IE 
[00174] If the starting time IE is present and at least one of the channel descriptions 
for before the starting time indicates frequency hopping, and none of the above 
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mentioned IE is present, a frequency list for after the starting time must be present, and 
this list applies also for the channels before the starting time. 

[00175] Reference cell frequency list: If any of the mobile allocation information 
elements are present, then the cell channel description IE must be present. It is used to 
decode the mobile allocation IBs in the message. In addition, if no information 
elements pertaining to before the starting time is present in the message, the frequency 
list defined by the cell channel description JE is used to decode the mobile allocation 
IBs in later messages received in the new cell until reception of a new reference cell 
frequency list or the new cell is left 

[00176] The Timing Advance IE element will be present if the "synchronization 
indication" element indicates a pre-synchronized handover. If not included for a pre- 
synchronized handover, then the default value as defined in GSM 05.10 shall be used. 
For other types of handover it shall be considered as an uimecessary information 
element. 

[00177] The CIPHER Mode Setting IE: If this information element is omitted, the 
mode of ciphering is not changed after the MS has switched to the assigned channel. 
The Multi Rate Configuration IE appears if the Mode of the First Channel IE indicates 
a multi-rate speech codec, and if the assigned configuration is new, i.e. it is different 
from the MultiRateconfiguration used in the serving cell. If the Mode of the First 
Channel IE indicates a multi-rate speech codec, and this IE is not included, then the MS 
shall assume that the MultiRateconfiguration has not changed. 

[00178] Figure 27 shows details of one embodiment of a URR HANDOVER 
FAILURE message. In addition to the basic lEs, this message includes a UMA RR 
Cause IE, with an applicable value as defined in the value table of Figure 14. 

Release of URR 

[00179] Release of the URR connection and signaling may be initiated by the MS or 
the UNC. Figure 28 shows a URR release that is initiated by an MS. At step A, a 
connection between MS 102 and UNC 140 is established, with the MS operating in the 
dedicated state. To release the URR, the MS sends a URR CLEAR REQUEST 
message 2800 to the UNC at step B. Details of one embodunent of the URR CLEAR 
REQUEST message are shown in Figure 29. This message format includes the basic 
lEs, with the message identified by the message type value. In response to the Uim 
CLEAR REQUEST message, the UNC sends a release request 2802 to the core 
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network to release resources used for the URR connection, as shown at step C. In 
response, the core network will initiate the release of the appropriate resources for the 
URR connection. The release typically results in the sequence shown in Figure 30. 
[00180] Figure 30 shows a message sequence corresponding to an URR release that 
is either initiated by the UNC or results when the UNC receives die URR CLEAR 
REQUEST message. . As before, at step A a connection between MS 102 and 
UNC 140 is established, with the MS operating in the dedicated state. At step B, the 
UNC sends a URR RR RELEASE message 3000 (alternatively called a URR 
RELEASE message) to the MS. (In further detail, the UNC will typically receive the 
URR CLEAR REQUEST, sends a Clear Request message to the MSC, tiien flie MSC 
releases the session, resulting in the UNC sending the URR RELEASE message.) In 
response, the MS returns a URR RR RELEASE COMPLETE message 3002 
(alternatively called a URR RELEASE COMPLETE message) to the UNC at step C. 
la addition the MS releases all URR resources and any traffic diannel resources and 
then enters a URR-IDLE state. 

[00181] Figure 31 shows details of one embodiment of a URR (RR) RELEASE 
message. In addition to the basic IBs, this message format includes a UMA RR Cause 
IE and an optional GPRS Resumption IE. The UMA RR Cause IE is used to define the 
reason for the release, via a corresponding value defined in the table-of Figure 14. The 
GPRS (General Packet Radio Service) Resumption IE is used to indicate whether the 
UNC has successfully resumed a GPRS session that the MS suspended when it started 
the URR session. 

[00182] Figure 32 shows details of one embodiment of a URR (RR) RELEASE 
COMPLETE message. This message format includes the basic lEs, with the message 
identified by the message type value. 

Paging Messages 

[00183] The UNC initiates paging when it receives a PAGING REQUEST message 
over the A-interface or a Paging CS message over the Gb-interface. The MS to be 
paged is identified by the identity received in the request An exemplary exchange of 
paging messages is shown in Figure 33. The sequence starts with UNC 140 sending a 
URR PAGING REQUEST message 3300 to MS 102 at step A. At step B, the MS 
returns a URR PAGING RESPONSE message 3302. This message is sent from the 
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MS to the UNC as the first message over the newly established UMA RR session in 
response to the URR PAGING REQUEST message. 

[00184] Figure 34 shows details of one embodiment of a URR PAGING REQUEST 
message. In addition to the basic lEs, this message format includes a Channel Needed 
IE (used to indicate whether the page is for signalmg session establishment or call 
establishment), and a Mobile Identity IE (used to identify the MS). 
[001851 Figure 35 shows details of one embodiment of a URR PAGING 
RESPONSE message. In addition to the basic lEs, this message format includes a 
Ciphering Key Sequence Number IE, a Channel Needed IE, and a Mobile Identity IE. 
The purpose of the Ciphering Key Sequence Number information element is to make it 
possible for the network to identify the ciphering key Kc which is stored in the mobile 
station without invoking an authentication procedure. Kc gets generated and stored 
when the MS is authenticated (challenged with a random number) by the network. 
While Kc is not used to encrypt the call when in UMA mode, it may be necessary if the 
call gets handed over to GSM. If the network does not authenticate every call (e.g., 
every 3 or 4 calls), the Ciphering Key Sequence Number IE provides a way to select a 
stored Kc value. 

Classmark Messages 

[00186] Classmark messages are used to enable a UNC to gain mformation about an 
MS's capabilities. The classmark interrogation procedure may be initiated when the 
MS has established a dedicated connection {le., the MS is in URR-DEDICATED 
mode), as shown at step A in Figure 36. As shown at step B, the UNC initiates the 
classmark interrogation procedure by sending a URR CLASSMARK ENQUIRY 
message 3600 to the MS. hi response, the MS returns a URR CLASSMARK 
CHANGE message 3602 at step C. 

[00187] Figure 37 shows details of one embodhnent of a URR CLASSMARK 
ENQUIRY message. The illustrated message format mcludes the basic lEs, with the 
message being identified by the message type value. 

[00188] Figure 38 shows details of one embodhnent of a URR CLASSMARK 
CHANGE message. In addition to the basic lEs, this message includes a Mobile State 
Classmark DB, and an Additional Mobile Station Classmark Information DE. The 
Mobile State Classmark IE includes the Classmark 2 information correspondmg to the 
frequency band currently being used by the GSM RR entity, as defined by GSM04,08. 
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An Additional Mobile Station Classmark Information IE will be included if the CM3 
bit in the Mobile Station Classmark IE is set to 1. This IE provides additional MS 
capabilities for Classmark 3 as defined by GSM04.08. 

UNC Architecture 

[00189] A block diagram illustrating a high level architecture corresponding to one 
embodiment of a UNC is shown in Figure 39. At the heart of the UNC architecture is 
an indoor network controller (INC) 3900. In general, the INC performs operations 
s3aionymous to those described above for the UNC. However, as shown in the 
illustrated UNC architecture, an integrated security gateway server 3902 is included, as 
well as a media gateway 3904 which is controlled by the INC. Accordingly, each of 
these elements is shown as a sq}arate element that is employed to facilitate various 
aspects of the UNC operations described herein. 

[00190] In general, the UNC may provide one or more communication ports to 
support communications between mobile stations and the UNC (e.g.^ via and AP 128 
and broadband IP network 138 as shown m Figure 1). For example, in the illustrated 
embodiment of Figure 39, security gateway server 3902 is coupled to IP network 138 
via an IP port 3906. In addition, JP ports 3908 and 3910 are used to connect INC 3900 
and media gateway 3904 to the security gateway server. 

[00191] The security gateway server 3902 performs security and authentication 
services. It may be an integrated xmit (as shown), or may be a separate (physical) unit 
connected to the UNC via an appropriate communication link. Likewise, media 
gateway 3904, which serves as a media gateway for voice services provided by the core 
network, may comprise an integrated uiiit (as shown) or a separate unit connected to the 
INC and security gateway servers via appropriate communication links. 
[00192] The INC 3900 includes resources to support (/.e, generate and process) the 
UP interface messages described herein. These resources are depicted as UP Interface 
(I/F) logic 3912. Sinularly, INC 3900 includes SGSN interface logic 3914 to support 
communications with SGSN 114 via a Gb port 3916, and MSC interface logic 3918 to 
support commxmication with MSC 110 via an SS7 port 3920. Meanwhile, media 
gateway 3904 includes MSC interface logic 3922 to support communication with 
MSC 110 via a TDM port 3924. Each of UP interface logic 3912, SGSN interface 
logic 3914, and MSC interface logic 3918 and 3922 may be implemented via execution 
of software, built-m programmed hardware, or a combination of the two. For example, 

47 



1 



wo 2005/114918 



PCT/US2005/016767 



UP interface logic 3912 may be facilitated by executing one or more software modules 
on a processor, wherein the software modules are coded to generate and/or process 
URR messages. 

[00193], In general, a UNC may be implemented by a single server, multiple 
distributed servers, and multiple clustered servers. For example, a single server 3926 
may be employed for running various software applications to provide the various 
functions shown in the block diagram of die UNC architecture of Figure 39. 
Optionally, some of the functions, such as the security gateway server functions and/or 
media gateway functions, may be provided by a separate server or servers. In yet 
another configuration, a blade server 3928 is employed. The blade server includes 
multiple server blades 3930 that are installed in a common rack or chassis, with each 
server blade functioning as a separate server, each with its own processor(s), memory, 
and network interfaces. In one embodiment, the functions provided by each of the 
security gateway server 3902, INC 3900, and media gateway 3904 are facilitated via 
execution of software applications and/or modules on respective server blades 3930. 

Mobile Station Architecture 
[00194] Figure 40 shows a block diagram illustrating a high-level architecture for 
one embodiment of a mobile station. The architecture includes a processor 4000 
coupled to a non-volatile memory 4002, a licensed RAN antenna sub-system 4004 and 
an unlicensed RAN antenna sub-system 4006, Non-volatile memory 4002 is used to 
store software/firmware instructions for performing various functions and operations 
described herein. These functions and operations are depicted licensed RAN interface 
logic 4008, WLAN interface logic 4010, and Up interface logic 4012. 
[00195] Licensed RAN antenna subs-system 4004 and licensed RAN interface 
logic 4008 are employed to facilitate conventional licensed RAN operations. For 
example, in one embodiment the licensed RAN comprises a GSM network, and thus 
these components facilitate normal GSM network operations typically employed by 
GSM-based cellular devices and the like, which are well-known in the cellular 
communication art. Meanwhile, the unlicensed RAN antenna system 4006 and WLAN 
interface logic 4010 are used to support an unlicensed wu^less channel link) 136 
with an access point 128 via which UMAN services may be accessed. In general, these 
blocks represent conventional components and logic employed to support 
communications over an unlicensed WLAN link. For example, these components are 
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illustrative of components that may be employed to implement the Bluetooth lower 
layers shown in Figure 3B for a Bluetooth link, or the 802.11 lower layers shown in 
Figure 3C for an 802.11 link, 

[00196] Up interface logic 4012 is used to provide the MS-side Up interface 
functions and operations described herein. This includes generating and processing 
various URR messages, as well as providing the various UP interface layers depicted in 
Figures 3A and 3D-F. 

[00197] As discussed above, the various message formats depicted herein are 
exemplary. However, each message should include a basic set of information elements 
including a protocol discriminator, a skip indicator, and a message identity. The 
inclusion of an UCI information element as a basic EB is depicted in the exemplary 
message formats illustrated herein; however, the UCI IE or a similar IE for indicating 
whether a message is a first message, other message, or emergency-related is not 
required and this functionality may be facilitated by other means, such as by 
maintaining appropriate state information on the communicating devices (ie., mobile 
stations and UNCs). 

[00198] Under a proposed implementation, message delmeation over a streaming 
transport (e.g., TCP) is p^ormed by the underlying transport itself. Accordingly, there 
is not a need to include an information element specifying the length of a variable- 
length message format. However, this is not meant to be limiting, as the use of an 
information element for specifying the length of a message is contemplated by the 
inventors as another means for delineating streamed messages. 
[00199] The formats of the various mformation elements is also merely exemplary. 
For example, a given set of information may be provided via a single IE or via multiple 
lEs. Furthermore, the information contained in the Es depicted herein may be 
arranged in other formats and/or grouped in alternate maimers. 
[00200] The means for facilitating various message generation and processing 
operations, as well as various aspects of the Up interface may include execution of 
software/firmware instructions on an appropriate processing element, such as, but not 
limited to, a processor, multiple processors, a multi-core processor, a microcontroller, 
etc. Thus, embodiments of this invention may be used as or to support instructions 
executed upon some form of processing core or otherwise implemented or realized 
upon or within a machine-readable medium. A machine-readable medium includes any 
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mechanism for storing or transmitting information in a form readable by a machine 
(e,g,, a computer). For example, a machine-readable medium can include a read only 
memory (ROM); a random access memory (RAM); a magnetic disk storage media; an 
optical storage media; and a flash memory device, etc. In addition, a machine-readable 
medium can include propagated signals such as electrical, optical, acoustical or other 
form of propagated signals (e,g., carrier waves, infrared signals, digital signals, etc.). 
For example, in one contemplated implementation, instructions embodied as software 
upgrades for facilitating UMA messaging may be downloaded to a mobile device via a 
wireless luik, such as a UMAN or GSM link. 

[00201] The above description of illustrated embodiments of the invention, including 
what is described in the Abstract, is not intended to be exhaustive or to limit the 
invention to the precise forms disclosed. While specific embodiments of, and examples 
for, the invention are described herein for illustrative purposes, various equivalent 
modifications are possible within the scope of the invention, as those skilled in the 
relevant art will recognize, 

[00202] These modifications can be made to the invention in light of the above 
detailed description. The terms used in the following claims should not be construed to 
limit the invention to the specific embodiments disclosed in the specification and the 
drawings. Rather, the scope of the invention is to be determined entirely by the 
following claims, which are to be construed in accordance with established doctrines of 
claim interpretation. 
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APPENDIX I: Table Of Acronyms 



AP 


Access Point 


ARFCN 


Absolute RF Channel Number 


ATM 


Asynchronous Transfer Mode 


ATMVC 


ATM Virtual Ckcuit 


BA 


BCCH Allocation 


BAS 


Broadband Access System 


BB 


Broadband 


BCCH 


Broadcast Conimon Control Channel 


BRAS 


Broadband Remote Access System 


BSC 


Base Station Controller 


BSS 


Base Station Subsystem 


BSSGP 


Base Station System GPRS Protocol 


BSSMAP 


Base Station System Management Application Part 


BTS 


Base Transceiver Station 


CDMA 


Code Division Multiple Access 


CGI 


Cell Global Identification 


CIC 


Circuit Identity Code 


CUP 


Calling Line Presentation 


CM 


Connection Management 


CPE 


Customer Premises Equipment 


CS 


Circuit Switched 


CVSD 


Continuos Variable Slope Delta modulation 


DSL 


Digital Subscriber Line 


DSLAM 


DSL Access Multiplexer 


DTAP 


Direct Transfer Application Part 


ETSI 


European Telecommunications Standards Institute 


FCAPS 


Fault-management, Configuration, Accounting, Performance, and 
Security 


FCC 


US Federal Communications Commission 


GERAN 


GSM Edge Radio Access Network 


GGSN 


Gateway GPRS Support Node 
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GMM/SM 


GPRS Mobility Management and Session Management 


GMSC 


Gateway MSC 


GSM 


Global System for Mobile Commmiication 


GPRS 


General Packet Radio Service 


GSN 


GPRS Support Node 


OTP 


GPRS Tunnelling Protocol 


HLR 


Home Location Register 


IAN 


Indoor Access Network (see also UMA Cell) 


lAN-RR 


Indoor Access Network Radio Resource Management 


IBS 


Indoor Base Station. 


mSAP 


IBS Application Protocol 


IBSMAP 


IBS Management Application Protocol 


DEP 


IAN Encapsulation Protocol 


IETF 


Internet Engineering Task Force 


MEI 


International Mobile Station Equipment Identity 


MSI 


International Mobile Subscriber Identity 


INC 


Indoor Network Controller 


.INC 


Indoor Network Controller 


IP 


Internet Protocol 


ISDN 


Integrated Services Digital Network 


ISP 


Internet Service Provider 


ISP IP 


Internet Service Provider's IP 


1ST 


IAN Secure Tunnel 


ISUP 


ISDN User Part 


rip 


IAN Transfer Protocol 


LA 


Location Area 


LAI 


Location Area Identification 


LLC 


Logical Link Control 


MAC 


Medium Access Control 


MAP 


Mobile Application Part 


MDN 


Mobile Directory Number 


MG 


Media Gateway 
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MM 


Mobility Management 


MM 


Mobility Management 


MS 


Mobile Station 


MSG 


Mobile Switching Center 


MSG 


Mobile Switching Genter 


MSISDN 


Mobile Station International ISDN Number 


MSRN 


Mobile Station Roaming Number 


MTPl 


Message Transfer Part Layer 1 


MTP2 


Message Transfer Part Layer 2 


MTP3 


Message Transfer Part Layer 3 


NAPT 


Network Address and Port Translation 


NAT 


Network Address Translation 


NS 


Network Service 


PGM 


Pulse Gode Modulation 


PGS 


Personal Gommunication Services 


PGS 


Personal Gommunications Services 


PLMN 


Public Land Mobile Network 


POTS 


Plain Old Telephone Service 


PPP 


Point-to-Point Protocol 


PPPoE 


PPP ova: EthCTnet protocol 


PSTN 


Public Switched Telephone Network 


P-TMSI 


Packet Temporary Mobile Subsoiber Identity 


QoS 


Quality of Service 


RA 


Routing Area 


RAG 


Routiag Area Code 


RAI 


Routing Area Identification 


RAI 


Routing Area Identity 


RAN 


Radio Access Network 


RF 


Radio Frequency 


RFG 


Request for Comment GETF Standard) 


RLG 


Radio Link Control 


RR 


Radio Resource Management 
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RTCP 


Real Time Control Protocol 


RTCP 


Real Time Control Protocol 


RTP 


Real Time Protocol 


RTP 


Real Time Protocol 


SAP 


Service Access Point 


SCCP 


Signaling Connection Control Part 


SCO 


Synchronous Connection-Oriented 


SDCCH 


Standalone Dedicated Control Channel 


SGSN 


Servmg GPRS Support Node 


SMC 


Short Message Service Centre 


SMS 


Short Message Service 


SM-SC 


Short Message Service Centre 


SMS-GMSC 


Short Message Service Gateway MSC 


SMS- 
IWMSC 


Short Message Service Interworking MSC 


SNDCP 


SubNetwork Dependent Convargence Protocol 


SS 


Supplementary Service 


SSL 


Secure Sockets Layer 


TCAP 


Transaction Capabilities Application Part 


TCP 


Transmission Control Protocol 


TCP 


Transmission Control Protocol 


TULI 


Temporary Logical Link Identity 


TMSI 


Temporary Mobile Subscriber Identity 


TRAU 


Transcoder and Rate Adaptation Unit 


TTY 


Text telephone or teletypewriter 


UDP 


User Datagram Protocol 


UMACell 


Unlicensed Mobile Access Cell (see also IAN) 


UMTS 


Universal Mobile Telecommunication System 


UNC 


UMA Network Controller (see also ffJC) 


VLR 


Visited Location Register 


VMSC 


Visited MSC 


WLAN 


Wireless Local Area Networic 
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WSPIP 



Wireless Service Provider's IP Network 
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CLAIMS 

What is claimed is: 

1. A method for releasing a URR (UMA (unlicensed mobile access) Radio 
Resource) connection between a mobile station (MS) and a UMA network controller 
(UNC) initiated by the MS, comprising: 

sending a URR CLEAR REQUEST message from the MS to the UNC, the 
URR CLEAR REQUEST message including a plurality of information elements (lEs) 
including, 

a protocol discriminator; 
a skip indicator; and 

a message type identifying the message as a URR CLEAR REQUEST 
message. 

2. The method of claim 1, further comprising: 

siding a request from the UNC to a core network employed by a licensed radio 
access network whose services are accessed by the MS via the UNC to release 
resources used for the URR connection. 

3. The method of claim 2, further comprising: 

releasing appropriate resources employed by the core network to support the 
URR connection. 

4. A method for releasing a URR (UMA (unlicensed mobile access) Radio 
Resource) connection between a mobile station (MS) and a UMA network controller 
(UNC) via initiation of the release by the UNC, comprising: 

sending a URR RELEASE message from the UNC to the MS; and 
returning a URR RELEASE COMPLETE message from the MS to the UNC, 
wherem each of the URR RELEASE and URR RELEASE COMPLETE 
messages includes a plurality of information elements (lEs), including, 

a protocol discrinunator; 

a skip indicator; and 
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a message type from which the message can be identified, 

5. The method of claim 4, wherein the URR RELEASE message further includes a 
UMA RR CAUSE IE containing a value from which a cause for the URR release may 
be determined via a UMA cause values lookup table. 

6. The method of claim 4, wherein the URR REI£ASE message further mcludes a 
GPRS (General Packet Radio Service) Resumption IE. 

7. The method of claim 4, further comprising: 

releasing all URR resources and any traffic channel resources at the MS; and 
havmg the MS enter a URR-IDLE state. 

8. A method for paging a mobile station (MS) via a unlicensed mobile access 
network (UMAN) including a UMA network controller (UNC) via which the MS has a 
URR connection to the UMAN, comprising: 

sending a URR PAGING REQUEST message from the UNC to the MS; and 
returning a URR PAGING RESPONSE message from the MS to the UNC, 
wherein each of the URR PAGING REQUEST and URR PAGING RESPONSE 
messages includes a plurality of information elements (EEs), including, 

a protocol discriminator; 

a skip indicator; and 

a message type from which the message can be identified, 
and wherem the PAGING REQUEST message further includes a Channel 
Needed IE identifymg a needed channel and a Mobile Identify IE identifying the MS. 

9. The method of claim 8, wherein the URR PAGING RESPONSE message 
further includes a Ciphering Key Sequence Number IE that specifies a ciphering key 
sequence number. 

10. The method of claim 8, wherein die URR PAGING RESPONSE message 
further includes a Mobile Station Classmark IE that specifies the capabilities for the 
MS. 
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11. The method of claim 8. wherein the URR PAGING RESPONSE message 
further includes a Mobile Identity IE via which the MS can be identified. 

12. The method of claim 8, further comprising: 

receiving, at the UNC, a PAGING REQUEST message over an A-interface 
used to support communication between the UNC and a core network accessible to a 
licmsed radio access network issuing the PAGING REQUEST message; 

determining an identity of an MS to be paged that is identified in the PAGING 
REQUEST message; 

gen^ating a URR PAGING REQUEST message for the MS that is identified; 

and 

sending the URR PAGING REQUEST message to that MS. 

13. The method of claim 8, further comprising: 

receiving, at the UNC, a Paging CS message over an Gb-interface used to 
support communication between the UNC and a core network accessible to a licensed 
radio access network issuing the Paging CS message; 

determining an identity of an MS to be paged that is identified in the Paging CS 
message; 

generating a URR PAGING REQUEST message for the MS that is identified; 

and 

sending the URR PAGING REQUEST message to that MS. 

14. A method for performing a classmark interrogation of a mobile station (MS) 
accessing an unlicensed mobile access network (UMAN) via a UMA network 
controller (UNC), comprising: 

establishing a URR (UMA Radio Resource) connection between the MS and the 

UNC; 

sending a URR CLASSMARK ENQUIRY message from the UNC to the MS; 

and 

returning a URR CLASSMARK CHANGE message from the MS to the UNC, 
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wherein each of the URR CLASSMARK ENQUIRY and URR CLASSMARK 
CHANGE messages includes a plurality of information elements (lEs), including, 
a protocol discriminator; 
a skip indicator; and 

a message type from which the message can be identified. 

15. The method of claim 14, wherein the URR CLASSMARK CHANGE message 
further includes a Mobile Station Classmark IE that contains information defining 
capabilities for the MS as defined by the Mobile Station Classmark 2 standard. 

16. The method of claim 15, wherein the URR CLASSMARK CHANGE message 
further includes an Additional Mobile Station Classmark Information IE that contams 
information defining capabilities for the MS as defined by the Mobile Station 
Classmark 3 standard. 

17. A method for providing classmark information for a mobile station (MS) 
accessing an unlicensed mobile access network (UMAN) via a UMA network 
controller (UNC), comprising: 

establishing a URR (UMA Radio Resource) connection between the MS and the 

UNC; 

sending a URR CLASSMARK CHANGE message from the MS to the UNC, 
the URR CLASSMARK CHANGE message includes a plurality of information 
elements (lEs), including, 

a protocol discriminator; 

a skip indicator; and 

a message type identifying the message as a URR CLASSMARK 
CHANGE message; and 

a Mobile Station Classmark IE that contains information defining 
capabilities for the MS as defined by the Mobile Station Classmark 2 standard. 
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18. The method of claim 17, wherein the URR CLASSMARK CHANGE message 
further includes an Additional Mobile Station Classmark Information IE that contains 
information defining capabilities for the MS as defined by the Mobile Station 
Classmark 3 standard. 

19. An unlicensed mobile access (UMA) network controller (UNC) to operate in a 
UMA network (UMAN) oomprismg a first radio access network, comprising: 

a first network mterf ace comprising an IP (Internet Protocol) Network interface; 

a second network interface comprising an Up inteiface, via which UMA 
messages are to be transmitted to and received fi:om a mobile station (MS) via an 
access point communicatively coupled between the MS and the UNC, the Up interface 
including a plurality of layers implemented over the IP network interface; 

a third network interface, via which the UNC may be connected to a core 
network that is accessible to a second radio access network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to support server-side URR 
communications with one or more MS clients in the UMAN, wherein each of the URR 
messages includes a set of basic information elements (BEs) including, 
a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified. 

20. The UNC of claim 19, wherein the URR messages include: 

a URR CLEAR REQUEST message sent j&rom the MS to the UNC to request 
release of resources corresponding to a URR connection established between the MS 
and the UNC, 

wherein in response to receiving the URR CLEAR REQUEST, the UNC 
processes the messages and sends a request to a core network employed by a licensed 
radio access network whose services are accessed by the MS via the UNC to release 
resources used for the URR connection. 

21. The UNC of claim 19, wherein the URR messages include: 
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a URR RELEASE message generated by and sent from the UNC to the MS to 
initiate release of resources corresponding to a URR connection established between 
the MS and the UNC; and 

a URR RELEASE COMPLETE message received from the MS in response to 
the URR RELEASE message and processed by the UNC. 

22. The UNC of claim 21, wherem the URR RELEASE message further includes a 
UMA RR CAUSE IE containing a value from which a cause for the URR release may 
be determined via a UMA cause values lookup table. 

23. The UNC of claim 21, wherein the URR RELEASE message further includes a 
GPRS (General Packet Radio Service) Resunq)tion DE. 

24. The UNC of claim 19, wherein the URR messages include: 

a URR PAGING REQUEST message generated by and sent from the UNC to the 
MS; and 

a URR PAGING RESPONSE message returned in response to the URR 
PAGING REQUEST from the MS to the UNC to be processed by the UNC. 

25. The UNC of claim 24, wherein the URR PAGING RESPONSE message further 
includes a Ciphering Key Sequence Number IE that specifies a ciphering key sequence 
number. 

26. The UNC of claun 24, wherem the URR PAGING RESPONSE message further 
includes a Mobile Station Classmark IE that specifies the capabilities for the MS. 

27. The UNC of claim 24, wherein the URR PAGING RESPONSE message further 
includes a Mobile Identity IE via which the MS can be identified. 

28. The UNC of claim 24, wherein the UNC further includes means for: 
receiving a PAGING REQUEST message from the core network over an A- 

interface employed by the third interface; 
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determining an identity of an MS to be paged that is identified in the PAGING 
REQUEST message; 

generating a URR PAGING REQUEST message for the MS that is identified; 

and 

sending the URR PAGING REQUEST message to that MS. 

29. The UNC of claim 24, wherein the UNC further includes means for: 
receiving a Paging CS message from the core network over an Gb-interface 

employed by the third interface; 

determining an identity of an MS to be paged that is identified in the Paging CS 
message; 

generating a URR PAGING REQUEST message for the MS that is identified; 

and 

sending the URR PAGING REQUEST message to that MS. 

30. The UNC of claim 19, wherein the URR messages include: 

a URR CLASSMARK ENQUIRY message generated by and sent from the 
UNC to the MS; and 

a URR CLASSMARK CHANGE message returned from the MS in response to 
the URR CLASSMARK ENQUIRY message from the MS to the UNC to be processed 
by the UNC 

31. The UNC of claim 30, wherein the URR CLASSMARK CHANGE message 
further includes a Mobile Station Classmark IE that contains information defining 
capabilities for the MS as defined by the Mobile Station Classmark 2 standard. 

32. The UNC of claim 31, wherein the URR CLASSMARK CHANGE message 
further includes an Additional Mobile Station Classmark Information IE that contains 
information defining capabilities for the MS as defined by the Mobile Station 
Classmark 3 standard. 

33. A mobile station (MS), comprising: 

a first wireless interface, to access a first radio access network; 
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a second wireless interface, to access a second radio access network comprising 
an unlicensed mobile access network (UMAN) via an access point (AP) using an 
unlicensed radio frequency; 

an Up interface to commimicate with the UMAN via a UMA network controller 
(UNC) communicatively coupled to the AP via an Internet Protocol (IP) network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to support client-side URR 
communications with one or more UNC servers in the UMAN, wherein each of the 
URR messages includes a set of basic information elements (IBs) including, 
a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified. 

34. The mobile station of claim 33, wherein the URR messages mclude: 

a URR CLEAR REQUEST message generated by and sent from the MS to an 
UNC to request release of resources corresponding to a URR connection established 
between the MS and the UNC 

35. The mobile station of claim 33, wherein the URR messages include: 

a URR RELEASE message sent from the UNC to the MS to initiate release of 
resources corresponding to a URR connection established between the MS and the 
UNC; and 

a URR RELEASE COMPLETE message generated by the MS and returned to 
the UNC from the MS in response to the URR RELEASE message. 

36. The mobile station of claim 33, wherein in response to the URR RELEASE 
message the mobile station performs operations including: 

releasing all URR resources and any traffic chamel resources associated with 
the URR connection; and 

entering a URR-IDLE state. 

37. The mobile station of claim 33, wherein the URR RELEASE message further 
includes a GPRS (General Packet Radio Service) Resumption BE, and in response to the 
URR RELEASE message the mobile station performs operations including: 
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Storing GPRS information contained in the GPRS Resumption IE; and 
employing the GPRS mformation when re-establishing GPRS services via the 
UMAN. 

38. The mobile station of claim 33, wherein the URR messages include: 
a URR PAGING REQUEST message sent from the UNC to the MS; and 

a URR PAGING RESPONSE message generated by the MS m response to the 
URR PAGING REQUEST and returned from the MS to the UNC. 

39. The mobile station of claun 33, wherein the URR PAGING RESPONSE 
message further includes a Ciphering Key Sequence Number IE that specifies a 
ciphering key sequence number. 

40. The mobile station of claim 33, wherein the URR PAGING RESPONSE 
message further includes a Mobile Station Classmark IE that specifies the capabilities 
for the MS. 

41 . The mobile station of claun 33. wherein the URR PAGING RESPONSE 
message further includes a Mobile Identity IE via which the MS can be identified. 

42. The mobile station of claim 33, wherein the URR messages include: 

a URR CLASSMARK ENQUIRY message sent from the UNC to the MS; and 
a URR CLASSMARK CHANGE message generated by and returned from tide 
MS to the UNC in response to the URR CLASSMARK ENQUIRY message. 

43. The mobile station of claim 42, wherein the URR CLASSMARK CHANGE 
message further includes a Mobile Station Classmark IE that contains information 
defming capabilities for the MS as defined by the MobUe Station Classmark 2 standard. 

44. The mobile station of claun 42, wherein the URR CLASSMARK CHANGE 
message further includes an Additional Mobile Station Classmark Information IE that 
contains information defining capabilities for the MS as defined by the Mobile Station 
Classmark 3 standard. 
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45. A machine readable medium, to provide respective portions of instructions to be 
executed on a mobile station (MS) and a unlicensed mobile access (UMA) network 
controller (UNC) to perform operations comprising: 

generating and processing a plurality of UMA (unlicensed mobile access) Radio 
Resource (URR) messages to support conununication between the MS and the UNC via 
an Up interface comprising a set of layered protocols over an underlying DP (Internet 
Protocol) transport, the underlying IP transport facilitated by a wireless link between 
the MS and an wireless access point (AP) to which the UNC is communicatively- 
coupled via an BP network, each URR message having a format includmg a set of basic 
information elements, including: 

a protocol discriminator; 

a skip uidicator; and 

a message type via which the message may be identified. 

46. The machme-readable niedium of claim 45, to provide further instructions to 
facilitate UNC server-side aspects of the Up interface. 

47. The machine-readable medium of claim 45, to provide further instructions to 
facilitate MS client-side aspects of the Up interface. 

48. The machine-readable medium of claim 45, wherein the URR messages 
include: 

a URR CLEAR REQUEST message generated by and sent from an MS to an 
UNC to request release of resources corresponding to a URR coimection established 
between the MS and the UNC. 

49. The machine-readable medium of claim 45,* wherein the URR messages 
include: 

a URR RELEASE message sent from a UNC to an MS to initiate release of 
resources corresponding to a URR connection established between the MS and the 
UNC; and 
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a URR RELEASE COMPLETE message generated by the MS and returned to 
the UNC from the MS in response to the URR RELEASE message. 

50. The machine-readable medium of claim'49, to provide further instructions that 
if executed on a mobile station perform operations in response to the URR RELEASE 
message, including: 

releasing all URR resources and any traffic channel resources associated with 
the URR connection; and 

entering a URR-IDLE state. 

5 1 . The machine-readable medium of claim 49, wherein the URR RELEASE 
message further includes a GPRS (General Packet Radio Service) Resmnption IE, and 
wherein the machine-readable medium provides furth^ instructions that if executed on 
a mobile station perform further operations in response to the URR RELEASE 
message, including: 

storing GPRS information contained in the GPRS Resumption IE; and 
employing the GPRS information when re-establishing GPRS services via the 
UMAN. 

52. The machine-readable medium of claim 45, wherein the URR messages 
include: 

a URR PAGING REQUEST message generated by and sent from a UNC to an MS; 
and 

a URR PAGING RESPONSE message generated by the MS in response to the 
URR PAGING REQUEST and returned from the MS to the UNC . 

53. The machine-readable medium of claim 52, wherein the URR PAGING 
RESPONSE message further includes a Ciphering Key Sequence Number IE that 
specifies a ciphering key sequence number. 

54. The machine-readable medium of claim 52, wherein the URR PAGING 
RESPONSE message further includes a Mobile Station Classmark IE that capabilities 
for the MS. 
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55. The machine-readable medium of claim 52, wherein the URR PAGING 
RESPONSE message further includes a Mobile Identity IE via which the MS can be 
identified. 

56. The machine-readable medium of claim 45, wherein the URR messages 
include: 

a URR CLASSMARK ENQUIRY message generated by and sent from the 
UNC to the MS; and 

a URR CLASSMARK CHANGE message generated by and returned from the 
MS to the UNC in response to the URR CLASSMARK ENQUIRY message. 

57. The machine-readable medium of claim 56, wherein the URR CLASSMARK 
CHANGE message further includes a Mobile Station Classmark IE that contains 
information defining capabilities for the MS as defined by the Mobile Station 
Classmark 2 standard. 

58. The machine-readable medium of claim 56, wherein the URR CLASSMARK 
CHANGE message further includes an Additional Mobile Station Classmark 
Information DE that contains information defining capabilities for the MS as defined by 
the Mobile Station Classmark 3 standard. 

59. A method for performing a handover from a first radio access network 
comprising a unlicensed mobile access network (UMAN) to a second radio access 
network; the method comprising: 

establishing a dedicated connection between a mobile station (MS) and the 
UMAN via a UMA network controller (UNC); 

determining that a handover from the UMAN is applicable; 

sending a URR (UMA Radio Resource) HANDOVER REQUIRED message 
from the MS to the UNC; and 

returning a URR HANDOVER COMMAND from the UNC to the MS, 
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wherein each of the URR HANDOVER REQUIRED message and the URR 
HANDOVER COMMAND message includes a set of basic information elements (lEs) 
including, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified, 
and wherein the URR HANDOVER REQUIRED message further includes at 
least one IE that identifies one or more cells operating in the second radio access 
network to which the MS may connect to complete the handover from the UMAN. 

60. The method of clahri 59, wherein the URR HANDOVER COMMAND message 
further includes: 

at least one information element containing information to support handover to 
the second radio access network. 

61. The method of claim 60, wherein the second radio access network comprises a 
GERAN (GSM (Global System for Mobile communications) EDGE Radio Access 
Network). 

62. The message of claim 59, further comprising: 

determining a handover from the UMAN is not successfully completed; and 
sending a URR HANDOVER FAILURE message from the MS to the UNC, the 
URR HANDOVER FAILURE message including the basic lEs and fuither including a 
UMA RR Cause IE having a value from whidi a cause for the failure can be identified 
via a corresponding lookup table. 

63. A method for performing a handover from a first radio access network to a 
second radio access network comprising a unlicensed mobile access network (UMAN); 
the method comprising: 

establishing a UMA connection between a mobile station (MS) and the UMAN 
via a UMA network controller (UNC); 

registering into the UMAN via the UNC; 
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sending a URR (UMA Radio Resource) HANDOVER ACCESS message from 
the MS to the UNC; 

establishing a channel between the MS and the UNC; 

sending a URR HANDOVER COMPLETE message from the MS to the UNC, 

wherein each of the URR HANDOVER ACCESS message and the URR 
HANDOVER COMPLETE message includes a set of basic information elements (DEs) 
including, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified; 
and wherein the URR HANDOVER ACCESS message further includes an IE 
containing an embedded Handover command layer 3 message. 

64. The method of claim 63, wherein the first radio access network comprises a 
GERAN (GSM (Global System for Mobile communications) EDGE Radio Access 
Network). 

65. An unlicensed mobile access (UMA) network controller (UNC) to operate in a 
UMA network (UMAN) comprising a first radio access network, comprising: 

a first network interface comprising an IP (Internet Protocol) Network interface; 
a second network interface comprising an Up interface, via which UMA 
messages are to be transmitted to and received from a mobile station (MS) via an 
access point communicatively coupled between the MS and the UNC, the Up interface 
including a plurality of layers implemented over the IP network interface; 

a third network interface, via which the UNC may be connected to a core 
network that is accessible to a second radio access network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to perform handovers between the 
UMAN and the second radio access network including, 

a URR HANDOVER REQUIRED message; 
a URR HANDOVER COMMAND message; and 
a URR HANDOVER COMPLETE message; 
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wherein each of the URR HANDOVER REQUIRED message, the URR 
HANDOVER COMMAND message, and the URR HANDOVER COMPLETE 
message includes a set of basic information elements (lEs) including, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified. 

66. The UNC of claim 65, wherem the URR HANDOVER REQUIRED message 
further includes at least one IE that identifies one or more cells operating in the second 
radio access network to which the MS may connect to complete the handover from the 
UMAN. 

67. The UNC of claim 65, wherein the URR HANDOVER COMMAND message 
further includes: 

at least one information element containing information to support handover to 
the second radio access network. 

68. The UNC of claim 65, further comprising means for processing a URR 
HANDOVER ACCESS message received from the MS via the Up interface, the URR 
HANDOVER ACCESS message including: 

a protocol discriminator IE; 
a skip indicator IE; 

a message type BE via which the URR HANDOVER ACCESS message may be 
identified; and 

an IE containing an embedded HANDOVER COMMAND layer 3 message. 

69. The UNC of claun 65, wherein the second network interface comprises a GSM 
A interface. 

70. A mobile station (MS), comprising: 

a first wireless interface, to access a furst radio access network; 
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a second wireless interface, to access a second radio access network comprising 
an unlicensed mobile access network (UMAN) via an access point (AP) using an 
unlicensed radio frequency; 

an Up interface to communicate with the UMAN via a UMA network controller 
(UNC) communicatively coupled to the AP via an Internet Protocol (IP) network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to perform handovers between the 
first wireless network and the UMAN including, 

a URR HANDOVER REQUIRED message; 
a URR HANDOVER COMMAND message; and 
a URR HANDOVER COMPLETE message; 

wherein each of the URR HANDOVER REQUIRED message, the URR 
HANDOVER COMMAND message, and die URR HANDOVER COMPLETE 
message includes a set of basic information elements (IBs) mcluding, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified. 

71. The mobile station of claim 70, wherein the URR HANDOVER REQUIRED 
message further includes at least one IE diat identifies one or more cells operating in 
the first radio access network to which the MS may connect to complete a handover 
fromtheUMAN. 

72. The mobile station of claim 70, wherein the URR HANDOVER COMMAND 
message further includes: 

at least one information element containing information to support handover 
from the first radio access network to the UMAN, 

73. The mobile station of claim 70, wherein the URR HANDOVER COMMAND 
message further includes: 

at least one information element containing information to support handover 
from (he UMAN to the first radio access network. 
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74. The mobile station of claim 70, further comprising means for generating a URR 
HANDOVER ACCESS message including: 

a protocol discriminator IE; 
a skip indicator IE; 

a message type IE via which the URR HANDOVER ACCESS message may be 
identified; and 

an IE containing an embedded HANDOVER COMMAND layer 3 message. 

75. The mobile station of claim 70, further comprising means for generating a URR 
HANDOVER FAILURE message including: 

a protocol discriminator IE; 
a skip indicator IE; and 

a message type IE via which the URR HANDOVER FAILURE message may 
be identified. 

76. The mobile station of claim 70, wherein the first radio access network 
comprises a GERAN (GSM (Global System for Mobile communications) EDGE Radio 
Access Network). 

77. A machine-readable medium, to provide respective portions of instructions to 
be executed on a mobile station (MS) and a unlicensed mobile access (UMA) network 
controller (UNC) to perform a handover from a first radio access network comprising a 
unlicensed mobile access network (UMAN) to a second radio access network by 
performing operations including: 

generating and processing a plxirality of UMA (unlicensed mobile access) Radio 
Resource (URR) handover messages to be transmitted between the MS and theUNC via 
an access point (AP) communicatively coupled between the MS and the UNC, the URR 
handover messages including a URR HANDOVER REQUIRED message, 

wherein each of the URR handover messages includes a set of basic information 
elements (IBs) including, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified; 
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and wherein the URR HANDOVER REQUIRED message further includes at 
least one IE that identifies one or more cells operating in the second radio access 
network to which the MS may connect to complete the handover from the UMAN. 

78. The machine-readable medium of clahn 77, wherein the URR handover 
messages further Include: 

a URR HANDOVER COMMAND message that, in addition to the basic lEs 
further includes: 

at least one information element containing information to support handover to 
the second radio access network* 

79. The machine-readable medium of claim 77, wherein the second radio access 
network comprises a GERAN (GSM (Global System for Mobile conununications) 
EDGE Radio Access Network). 

80. The machine-readable medium of claim 77, further providing instructions that if 
executed perform operations comprising: 

determining a handover from the UMAN is not successfidly completed; and 
generating at and sending a URR HANDOVER FAILURE message from the 
MS to the UNC, the URR HANDOVER FAILURE message including the basic IBs 
and further includmg a UMA RR Cause IE having a value from which a cause for the 
failure can be identified via a corresponding lookup table. 

8L A machine-readable medium, to provide respective portions of instructions to 
be executed on a mobile station (MS) and a unlicensed mobile access (UMA) network 
controller (UNC) to perform a handover from a first radio access network to a second 
radio access network comprising a unlicensed mobile access network (UMAN) by 
performing operations including: 

establishing a UMA connection between the mobile station and the UMAN via 
a the (UNC); 

registering into the UMAN via the UNC; 

sending a URR (UMA Radio Resource) HANDOVER ACCESS message from 
the MS to the UNC; 
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obtaining a traffic channel assignment for the MS; and 

sending a URR HANDOVER COMPLETE message from the MS to the UNC. 

wherein each of the URR HANDOVER ACCESS message and the URR 
HANDOVER COMPLETE message includes a set of basic information elements (lEs) 
including, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified; 
and wherein the URR HANDOVER ACCESS message further includes an IE 
containing an embedded Handover command layer 3 message. 

82. The machine-readable medium of claim 81, wherein the second radio access 
network comprises a GERAN (GSM (Global System for Mobile communications) 
EDGE Radio Access Network), 

83. The machine-readable medium of claim 81, further providing additional 
respective portions of instructions to be executed on the MS and the UNC to perform 
operations comprising: 

sending a URR HANDOVER COMMAND message including appropriate DBs 
containing information via which the MS can establish a dedicated connection with the 
UMAN from the UNC to the MS m response to registration of the MS into the UMAN; 
and 

embedding the URR HANDOVER COMMAND message in the URR 
HANDOVER ACCESS message. 

84. A method for registering a mobile station (MS) with an unlicensed mobile 
access network (UMAN), comprising: 

establishing a wireless local area netwo± (WLAN) link between the MS and an 
wireless access point (AP); 

establishing a first TCP (Transmission Control Protocol) session between the 
MS and a first UMA network controUra: (UNC) communicatively coupled to the AP; 
and 
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sending a plurality of URR (UMA Radio Resource) registration messages 
between the MS and the first UNC over the first TCP session including a URR 
REGISTER REQUEST message sent from the MS to the first UNC; 

wherein each of the URR registration messages includes a set of basic 
mf ormation elements (IBs) including, 
a protocol discriminator; 
a skip indicator, and 

a message type via which the message may be identified; 
and wherein the URR REGISTER REQUEST message furlher includes, 

a Mobile Identity IE via which the MS may be identified; 

a GSM Radio Resource (RR) state IE defining whether the MS is in a 
GSM RR idle or dedicated state; and 

an AP Identifier IE. 

85. The method of claim 84, further comprising: 

sending a URR REGISTER REJECT message from the first UNC to the MS to 
indicate the registration of the MS has been rejected by the UMAN, 

86. The method of claim 84, further comprising: 

determining that a second UNC is better suited for serving the MS; 

sending a URR REGISTER REDIRECT message from the first UNC to the 
MS, the URR REGISTER REDIRECT message including information for accessing 
the second UNC; 

releasing the connection to the first UNC; 

establishing a second TCP session with the second UNC; and 

sending a URR REGISTER REQUEST message from the MS to the second 
UNC via the second TCP session. 

87. The method of claim 86, wherem the information for accessing the second UNC 
includes at least one of: 

a first IE having a value that is a fully-qualified domain name (FQDN) or DP 
address for the second UNC; and 
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a second IE having a value that is a fully-qualified domain name (FQDN) or IP 
address for a security gateway hosted by the second UNC. 

88. The method of claim 86, further comprising: 

sending a URR REGISTER ACK message from the first UNC to the MS to 
indicate the registration of the MS has been accepted by the UMAN. 

89. The method of claim 88, further comprising: 

detecting a change in one of cell information or a change in the AP serving the 
MS since one of a last registration or update; and 

sending a URR REGISTER UPDATE UPLINK message from the MS to the 
first UNC containing information corresponding to the change in the cell information or 
servmg AP. 

90. The method of claim 89, further comprising: 

returning a URR REGISTER REDIRECT message from the first UNC to the 
MS, the URR REGISTER REDIRECT message including information to redirect the. 
MS to a second UNC. 

91. The method of claim 89, wherein the URR REGISTER UPDATE UPLINK 
message is sent in response in a change to a new AP serving the MS, and the URR 
REGISTER UPDATE UPLINK message includes an AP location IE identifying a 
location of the new AP. 

92. The method of claim 89, further comprising: 

returning a URR DEREGESTER message from the first UNC to the MS, the 
URR DEREGISTER message including information identifying why the registration 
update was rejected. 

93. The method of claim 88, further comprising: 
detecting a network-initiated update event; 

sending a URR REGISTER UPDATE DOWNLINK message from the first 
UNCtotheMS. 
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94. The method of claim 93 , further comprising: 

returning a URR REGISTER REDIRECT message from the first UNC to the 
MS, the URR REGISTER REDIRECT message including information to redirect the 
MS to a second UNC. 

95. The method of claim 84, further comprising: 

sending a URR DEREGISTER message from the first UNC to the MS, the URR 
DEREGISTER message including an BB from which a cause for the deregistration may 
be identified. 

96. An unlicensed mobile access (UMA) network controller (UNC) to operate in a 
UMA network (UMAN) comprising a first radio access network, comprising: 

a first network interface comprising an IP (Intemet Protocol) Network interface; 

a second network interface comprising an Up interface, via which UMA 
messages are to be transmitted to and received from a mobile station (MS) via an 
access point cormnunicatively coupled between the MS and the UNC, the Up interface 
including a plurality of layers implemented over the IP network interface; 

a third network interface, via which the UNC may be connected to a core 
network that is accessible to a second radio access network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to support registration of mobile 
stations in the UMAN, including, 

a URR REGISTER REQUEST message; 
a URR REGISTER ACK message; and 
a URR REGISTER REJECT message; 

wherein each of the URR REGISTER REQUEST message, the URR 
REGISTER ACK message, and the URR REGISTER REJECT message includes a set 
of basic information elements (lEs) including, 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified, 
and wherein the URR REGISTER REQUEST message further includes, 
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a Mobile Identity IE via which the MS may be identified; 
a GSM Radio Resource (RR) state IE defining whether the MS is in a 
GSM RR idle or dedicated state; and 
an AP Identifier IE. 

97. The UNC of claim 96, further comprismg means for graerating a URR 
REGISTER REDIRECT message, the URR REGISTER REDIRECT message 
including at least one of: 

a first IE having a value that is a fully-qualified domain name (FQDN) or IP 
address for the second UNC; and 

a second BE havmg a value that is a fiilly-qualified domain name (FQDN) or IP 
address for a security gateway hosted by the second UNC, 

98. The UNC of claim 96, wherein the URR REGISTER REJECT message further 
includes: 

an IE including information fi:om which a cause for the rejection of the 
registration can be identified. 

99. The UNC of claim 96, further comprising means for generating a URR 
REGISTER UPDATE DOWNLINK message. 

100. The UNC of claim 96, further comprising means for generating a URR 
DEREGISTER message. 

101. The UNC of claim 96, wherein the third network interface comprises an 
interface to a GERAN core network. 

102. A mobile station (MS), comprising: 

a first wireless interface, to access a first radio access network; 

a second wireless interface, to access a second radio access network comprising 
an unlicensed mobile access network (UMAN) via an access point (AP) using an 
unlicensed radio frequency; 
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an Up interface to communicate with the UMAN via a UMA network controller 
(UNC) communicatively coupled to the AP via an Internet Protocol (IP) network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to support registration of the MS in 
the UMAN, including, 

a URR REGISTER REQUEST message; 
a URR REGISTER ACK message; and 
a URR REGISTER REJECT message; 
wherein each of the URR REGISTER REQUEST message, the URR 
REGISTER ACK message, and the URR REGISTER REJECT message mcludes a set 
of basic information elements (lEs) including, 
a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified, 

and wherein the URR REGISTER REQUEST message further includes, 

a Mobile Identity IE via which the MS may be identified; 

a GSM Radio Resource (RR) state IE defining whether the MS is in a 
GSM RR idle or dedicated state; and 
an AP Identifier IE. 

103. The mobile station of claim 102, further comprising: 

means for detecting a change in one of licenced cell information or a change in 
the AP serving the MS since one of a last registration or update; and 

means for generating a URR REGISTER UPDATE UPLINK message to be 
sent to the UNC, the URR REGISTER UPDATE UPLINK message containing 
information corresponding to the change in the licensed cell information or serving AP. 

104. The mobile station of claim 102, further comprising: 

means for performing a DNS (Domain Name Server) query for UNCs in the 
UMAN that may be accessed via the AP. 
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105. The mobile station of claim 102, wherein the first radio access network 
comprises a GERAN (GSM (Global System for Mobile communications) EDGE Radio 
Access Network). 

106. A machine-readable medium, to provide respective portions of instructions to 
be executed on a mobile station (MS) and one or more unlicensed mobile access 
(UMA) network controllers (UNCs) to perform operations comprising: 

generating and processing a plurality of UMA (unlicensed mobile access) Radio 
Resource (URR) registration messages exchanged between flie MS and one or more 
UNCs to support registration of the MS in a UMA network (UMAN), the URR 
registration messages sent over a Up interface comprising a set of layered protocols 
implemented over an underlymg IP (Ihtemet Protocol) transport, the underlying IP 
transport facilitated by a wireless link between the MS and a wureless access point (AP) 
to which the one or more UNCs are communicatively-coupled via an IP network, the 
message exchange including sending a URR REGISTER REQUEST message 
generated by the MS from the MS to a first UNC, 

wherein each URR message includes a set of basic information elements (lEs), 
including: 

a protocol discriminator; 

a skip indicator; and 

a message type via which the message may be identified. 

107. The machine-readable medium of claim 106, wherein the lEs m the URR 
REGISTER REQUEST message further include: 

a Mobile Identity IE via which the MS may be identified; 
a GSM Radio Resource (RR) state IE defining whether the MS is in a GSM RR 
idle or dedicated state; and 
an AP Identifier IE. 

108. The machine-readable medium of claim 106, wherein the URR registration 
messages further include: 

a URR REGISTER REJECT message that is generated by a UNC and sent to an 
MS to indicate the registration of the MS has been rejected by the UMAN. 
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109. The machine-readable medium of claim 106, further providing instructions that 
if executed perform operations including: 

establishing a wireless local area network (WLAN) link between the MS and a 
wireless access point (AP); 

establishing a first TCP (Transmission Control Protocol) session between the 
MS and a first UNC communicatively coupled to the AP; 

sending a first URR REGISTER REQUEST message from the MS to the first 
UNC via the first TCP session; 

determining that a second UNC is better suited for serving the MS; 

sending a URR REGISTER REDIRECT message from the first UNC to the 
MS, the URR REGISTER REDIRECT message including information for accessing 
the second UNC; 

releasing the connection to the first UNC; 

establishing a second TCP session with the second UNC; and 

sending a URR REGISTER REQUEST message from the MS to the second 
UNC via the second TCP session. 

1 10. The machine-readable medium of claim 109, wherem the information for 
accessing the second UNC includes at least one of: 

a first IE having a value that is a fully-qualified domain name (FQDN) or IP 
address for the second UNC; and 

a second IE having a value that is a fully-qualified domain name (FQDN) or IP 
address for a security gateway hosted by the second UNC. 

111. The machine-readable medium of claim 106, wherein the URR registration 
messages further include: 

a URR REGISTER ACK message sent from a UNC to an MS to indicate the 
registration of the MS has been accepted by the UMAN. 

1 12. The machine-readable medium of claim 106, wherem the URR registration 
messages further include: 
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a URR- REGISTER UPDATE UPLINK message sent from an MS to a UNC to 
containing inf omation corresponding to a change in licensed cell information or 
serving AP. 

113. The machine-readable medium of claim 1 12, wherein the URR REGISTER 
UPDATE UPLINK message is sent in response in a change to a new AP serving the 
MS, and the URR REGISTER UPDATE UPLINK message includes an AP location IE 
identifying a location of the new AP. 

1 14. The machme-readable medium of claim 106, further providing mstructions that 
if executed p^form operations including: 

determining that a second UNC is better suited for serving the MS than the first 
UNC; and 

returning a URR REGISTER REDIRECT message from the first UNC to the 
MS, the URR REGISTER REDIRECT message including mformation to redirect the 
MS to the second UNC. 

115. The machine-readable medium of claim 106, wherem the URR registration 
messages further include: 

a URR REGISTER UPDATE DOWNLINK message generated by a UNC and 
sent from the UNC to an MS. 

116. The machine-readable medium of claim 106, to provide further instructions to 
facilitate UNC server-side aspects of the Up interface. 

117. The machine-readable medium of claim 106, to provide further mstructions to 
facilitate MS client-side aspects of the Up interface. 

118. The machine-readable medium of claim 106, wherem the URR registration 
messages further include: 

a URR DEREGISTER message that is generated by a UNC and sent to an MS 
to initiate deregistration of the MS, the URR DEREGISTER message including an IE 
from which a cause for the deregistration may be identified. 
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1 19. A method for assigning a voice bearer channel for a mobile station (MS) to 
access voice bearer services hosted by a first radio access network via an unlicensed 
mobile access network (UMAN) comprising a second radio access network, the method 
comprising: 

establishing a wireless local area network (WLAN) link between the MS and a 
wireless access point (AP); 

establishing a dedicated connection between the MS and a UMA network 
controller (UNC) commmiicatively coupled to the AP; and 

sending a plurality of URR (UMA Radio Resource) channel activation 
messages between the MS and the UNC to assign the voice bearer channel, the URR 
channel activation messages mcluding a URR ACTIVATE CHANNEL message sent 
from the UNC to the MS to initiate assignment of the voice bearer channel, 

wherein eadi of the URR channel activation messages includes a set of basic 
information elements (lEs) including, 
a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified; 
and wherein the URR ACTIVATE CHANNEL message further includes, 

a Channel Mode IE, including information specifying a channel mode to 
be used for the voice bearer channel. 

120. The method of claim 1 19, further comprising: 

sending a URR ACTIVATE CHANNEL ACK message from the MS to the 
UNC acknowledging successful activation of the voice bearer channel. 

121. The method of claim 120, further comprising: 

returning a URR ACTIVATE CHANNEL COMPLETE message from the UNC 
to the MS to indicate the voice bearer channel is available for uplink. 

122. The method of claim 1 19, further comprising: 

sending a URR ACTIVATE CHANNEL FAILURE message from the MS to 
the UNC indicatmg the MS failed to activate the voice bearer channel. 
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123. The method of claim 1 19, wherein the URR ACTIVATE CHANNEL message 
further includes cipher mode setting information for use in case of a handover to the 
first radio access network. 

124. The method of claim 123, wherein the first radio access network comprises a 
GERAN (GSM (Global System for Mobile communications) EDGE Radio Access 
Network). 

125. The method of claim 1 19, wherein the URR ACTIVATE CHANNEL message 
further includes at least one IE containing information identifying parameters to be 
employed in a uplink portion of the voice bearer channel, the information identifying at 
least one of: 

an IP address for the uplink to the UNC; 
a transport port address; 
a transport protocol; 
a sample size; and 
a payload type. 

126. An unlicensed mobile access (UMA) network controller (UNC) to operate in a 
UMA network (UMAN) comprising a first radio access network, comprising: 

a first network interface comprising an IP (Internet Protocol) Network interface; 

a second network interface comprising an Up interface, via which UMA 
messages are to be transmitted to and received from a mobile station (MS) via an 
access point communicatively coupled between the MS and the UNC, the Up interface 
including a plurality of layers implemented over the IP network interface; 

a third network interface, via which the UNC may be connected to a core 
network that is accessible to a second radio access network; and 

means for generatuig and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up mterface to support assignment of voice 
bearer channels for mobile stations in the UMAN, including a URR ACTIVATE 
CHANNEL message generated by the UNC and sent to an MS to initiate assignment of 
a voice bearer channel to the MS; 
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wherein each of the URR messages includes a set of basic information elements 
(DEs) including, 

a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified, 
and wherein the URR ACTIVATE CHANNEL message further includes, 

a Channel Mode IE, including information specifying a channel mode to 
be used for the voice bearer channel. 

127. The UNC of claim 126, further comprising means for processing a URR 
ACTIVATE CHANNEL ACKNOWLEDGE message sent from an MS to the UNC 
acknowledging successful activation of the voice bearer channel. 

128. The UNC of claun 126, further comprising means for generating a URR 
ACTIVATE CHHANEL COMPLETE message that is sent from the UNC to the MS to 
indicate the voice bearer channel is available for uplink. 

129. The UNC of claim 126, wherein the URR ACTIVATE CHANNEL message 
further includes cipher mode setting information for use in case of a handover to the 
first radio access network. 

130. The UNC of claim 126, wherein the second radio access network comprises a 
GERAN (GSM (Global System for Mobile communications) EDGE Radio Access 
Network). 

131. The UNC of claim 126, wherein the third network interface comprises an A 
interface. 

132. The UNC of claim 126, wherein the URR ACTIVATE CHANNEL message 
further includes at least one IE containing information identifying parameters to be 
employed m a uplink portion of the voice bearer channel, the information identifying at 
least one of: 

an IP address for the uplink to the UNC; 
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a transport port address; 
a transport protocol; 
a sample size; and 
a payload type. 

133. A mobile station (MS), comprising: 

a first wireless interface, to access a first radio access network; 

a second wireless iaterface, to access a second radio access network comprising 
an unlicensed mobile access network (UMAN) via an access point (AP) using an 
unlicensed radio frequency; 

an Up interface to communicate with the UMAN via a UMA network controller 
(UNC) communicatively coupled to the AP via an Internet Protocol (IP) network; and 

means for generating and/or processing a plurality of UMA radio resource 
(URR) messages transmitted over the Up interface to support assignment of a voice 
bearer channel for the MS in the UMAN, including means for processing a URR 
ACTIVATE CHANNEL message sent to the MS from the UNC to uiitiate assignment 
of a voice bearer channel to the MS; 

wherein each of the URR messages includes a set of basic information elements 
(lEs) including, 

a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified, 
and wherein the URR ACTIVATE CHANNEL message ftirther includes, 
a Channel Mode IE, including information specifying a channel mode to be 
used for the voice bearer channel. 

134. The mobile station of claim 133, further comprising: 

means for generating a URR ACTIVATE CHANNEL ACK message sent from 
an MS to the UNC acknowledging successful activation of the voice bearer channel. 

135. The mobile station of claim 133, wherein the URR ACTIVATE CHANNEL 
ACK message further includes at least one BE containing information identifying 
pjirameters to be employed in a downlink portion of the voice bearer channel, the 
information identifying at least one of: 

86 



wo 2005/114918 



PCTAJS2005/016767 



an IP address for the downlink to the MS; 
a transport port address; 
a transport protocol; 
a sample size; and 
a payload type. 

136. The mobile station of claim 133, further comprising: 

means for generating a URR ACTIVATE CHANNEL FAILURE message sent 
firom an MS to the UNC to indicate activation of the voice bearer channel was not 
successful. 

137. The mobUe station of claim 133. wherein the URR ACTIVATE CHANNEL 
message further includes cipher mode setting information for use in case of a handover 
to the fu:st radio access network. 

138. The mobile station of claim 133, wherein the first radio access network 
comprises a GERAN (GSM (Global System for Mobile communications) EDGE Radio 
Access Network). 
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139» A machine-readable medium, to provide respective portions of instructions to 
be executed on a mobile station (MS) and a unlicensed mobile access (UMA) network 
controller (UNC) to assign a voice bearer channel for the MS to access voice bearer 
services hosted by a first radio access network via an unlicensed mobile access network 
(UMAN) comprising a second radio access network by performing operations 
comprising: 

generating and processing a plurality of UMA (imlicensed mobile access) Radio 
Resource (URR) chaimel activation messages to assign a voice bearer channel for the 
MS in tibe UMAN, the URR channel activation messages sent over an Up uiterface 
comprising a set of layered protocols implemented over an underlying IP (Internet 
Protocol) transport, the underlying IP transport facilitated by a wireless link between 
the MS and a wneless access point (AP) to which the UNC is commuiucativeiy- 
coupled via an IP network, the URR channel activation messages including a URR 
ACTIVATE CHANNEL message sent from the UNC to the MS to initiate assignment 
of the voice bearer channel, 

wherein each of the URR channel activation messages uicludes a set of basic 
information elements (lEs) including, 
a protocol discriminator; 
a skip indicator; and 

a message type via which the message may be identified; 
and wherein the URR ACTIVATE CHANNEL message further includes, 
a Channel Mode IE, including information specifying a channel mode to be 
used for the voice bearer channel. 

140. The machine-readable medium of claim 139, wherein the URR channel 
activation messages further include: 

a URR ACTIVATE CHANNEL ACK message generated by and sent from an 
MS to a UNC acknowledging successful activation of the voice bearer channel. 

141 . The machine-readable medium of claim 139, wherein the URR channel 
activation messages further include: 



88 



wo 2005/114918 



PCTAJS2005/016767 



a URR ACTIVATE CHANNEL COMPLETE message that is generated by and 
sent from a UNC to an MS to indicate the voice bearer channel is available for uplink. 

142. The machine-readable medium of claim 139, wherein die URR channel 
activation messages further include: 

a URR ACTIVATE CHANNEL FAILURE message that is generated by and 
sent from an MS to a UNC to indicate the MS failed to activate the voice bearer 
channel. 

143. The machme-readable medium of claim 139, wherem the URR ACTIVATE 
CHANNEL message further includes cipher mode setting information for use m case of 
a handover to the first radio access network. 

144. The machine-readable medium of claim 139, wherein the first radio access 
network comprises a GERAN (GSM (Global System for Mobile communications). 
EDGE Radio Access Network). 

145. The machine-readable medium of claim 139, to provide ftirther instructions to 
facilitate UNC server-side aspects of the Up interface. 

146. The machine-readable medium of claim 139, to provide further instructions to 
facilitate MS client-side aspects of the Up interface. 

147. The machine-readable medium of claim 139, wherein the URR ACTIVATE 
CHANNEL message further includes at least one IE containing information identifying 
parameters to be employed in a uplink portion of the voice bearer channel, the 
information identifying at least one of: 

an IP address for the uplink to the UNC; 
a transport port address; 
, a transport protocol; 
a sample size; and 
a payload type. 
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D 
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UNG ' ^140 
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Sldo Indicator 
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M 


V 
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UCI 
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M 


V 


1 
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Redirected UNC 
Address 


FQDN or IP address 


0 


LV 






Redirected SGW 
Address 
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0 


LV 






Status 


Status 


0 


TLV 







Fig. 12 1002 
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URR CAUSE VALUES 



Bit 


Decimal 


Description 


8 


7 


6 




4 






1 






0 


0 


0 


0 


0 


0 


A 

0 


A 

0 


0 


Normal event 


0 


0 


0 


0 


0 


0 


0 


1 


1 


Abnormal release, unspecified 


0 


0 


0 


0 


0 


0 


1 


0 


2 


Abnormal release, channel unacceptable 


0 


0 


0 


0 


0 


0 


1 


1 


3 


Abnormal release, timer expired 


0 


0 


0 


0 


0 


1 


0 


0 


4 


Abnomial release, no activity on the radio path 


0 


0 


0 


0 


0 


1 


0 


1 


5 


Preemptive release 


0 


0 


0 


0 


1 


0 


0 


0 


8 


Handover bnpossible, timing advance out of 
range 


0 


0 


0 


0 


1 


0 


0 


1 


9 


Channel mode unacceptable 


0 


0 


0 


0 


1 


0 


1 


0 


10 


Frequency not implemented 


0 


1 


0 


0 


0 


0 


0 


1 


65 


Call already cleared 


0 


1 


0 


1 


1 


1 


1 


1 


95 


Semantically incorrect message 


0 


1 


1 


0 


0 


0 


0 


0 


96 


Invalid mandatory information 


0 


1 


1 


0 


0 


0 


0 


1 


97 


Message type non-existent or not 
implemented 


0 


^ 


1 


0 


0 


0 


A 

1 


A 

u 


98 


Message type not compatible with protocol 
state 


0 




1 


0 


0 


1 


0 


0 


100 


Conditional IE enror 


0 


1 


1 


0 


0 


1 


0 


1 


101 


No cell allocation available 


0 




1 


0 


1 


1 


1 


1 


111 


Protocol error unspecified 


1 


0 


0 


0 


1 


1 


0 


0 


140 


Unauthortzeed sid)scriber 




0 


0 


0 






0 


1 


141 


Radio channel bearer failure 




0 


0 


0 






1 


0 


142 


GSM RR busy 




0 


0 


0 






1 


1 


143 


T1811 timeout 




0 


0 




0 


0 


0 


0 


144 


Link detach 




0 


0 




0 


0 


0 


1 


145 


TI9G0 timeout 




0 


0 




0 


0 


1 


0 


146 


Signaling CHANNEL FAILURE 




0 


0 




0 


0 


1 


1 


147 


MS is not attached 




0 


0 




0 


1 


0 


0 


148 


Loss of radio connection 




0 


0 




0 


1 


0 


1 


149 


Radio channel assignment failure 




0 


0 




0 


1 


1 


0 


150 


VoIP channel establishment failure 



Fig. 14 



wo 2005/114918 



PCT/US2005/016767 



18/30 



MS 



102 



AP .^128 



UNC ' 
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URR ACTIVATE CHANNa 
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I 
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c 



URRACTIVATE CHANNEL 

1506 \_ 



X.. 



URR ACTIVAT E CHANNEL COMPLETE 
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Fig. 15 



B 

C 
C 
D 



URR ACTIVATE CHANNEL 
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Format 
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UMARR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 




0110 


SkiD Indicator 


SkiD Indicator 


M 


V 


% 


OGOG 


URR 

ACTIVATE 
CHANNEL 
MessaoeTvpe 


Message type 


M 


V 


1 


00101110 


UCI 


UCI 


M 


V 


1 


0,1 or9 


Channel Mode 


Channel Mode 


M 


V 


1 


10.5.2.6/QSM04,08 


UNC SOP 


SOP 


M 


LV 




Per RFC 2327, 
RFC 3551 and RFC 

3267 


CIPHER Mode 
Setting 


CIPHER Mode . 
Setting 


0 


TV 


1 


10.5.2.9/GSM04.08 



Fig. 16 
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URR ACTIVATE CHANNEL ACK 
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M 
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M 
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URR 
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Messaqe Type 


Message type 


M 


V 


1 
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UCI 


UCI 


M 


V 


1 


0. 1 or9 
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SDP 


M 


LV 




Per RFC 2327, 
RFC 3551 and RFC 
3267 


Cell Identifier 
List 
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Cell Identifier List 


0 


TLV 


7n+3 
(a<n<8) 


3.2.2.27/GSIi/l08.08 


CI List 


CI List 


C 


TLV 


n+2 

(0<n<8) 


CI Range: [0.63] 



Fig. 17 
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V 


)i 


0110 
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M 


V 
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URR 

ACTIVATE 
CHANNEL 
FAILURE 
Message Type 


Message type 


M 


V 


1 


00101111 1 


UCI 


UCI 


M 


V 


1 
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UMA RR Cause 


UMA RR Cause 


M 


V 
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Cell Identifier 
List 

(Preferred) 


Cell Identifier List 


0 


TLV 


7n+3 
(0<n<8) 


3.2.2.27/GSM08.08 


CI List 


ClUst 


C 


TLV 


(0<n<8) 


CI Range: [0,63] 
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URR ACTIVATE CHANNEL COMPLETE 
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UIVIARR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 




0110 


SkiD Indicator 


Skip Indicator 


M 


V 


V4 


0000 


URR ACTIVATE 
CHANNEL 
COMPLETE 
MessaaeTvpe 


Message type 


M 


V 


1 


0010 1010 


ua 


UC! 


M 


V 


1 
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Fig. 19 



URR HANDOVER ACCESS 



Information 
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Vahie 


UMARR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 




0110 


Skip Indicator 


Sl(ii) Indicator 


M 


V 




0000 


URR 

HANDOVER 
ACCESS 
Message Type 


Message type 


M 


V 


1 


00101101 


UCI 


UCI 


M 


V 


Vi 


1or9 


HANDOVER 

COMMAND 

message 


HANDOVER 
COMMAND layer 3 
message 


M 


V 


variable 


9.1.15/GSM04.08 



Fig. 21 
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Fig. 20 
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URR HANDOVER ACCESS 



c 



Traffic Channel Assignment 



2002 



URR HANDOVER COMPLETE 
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B 

C 



MS '^102 



AP ^ 



'128 



UNC ' ^140 



Fig. 23 A 



Connection Established (Dedicated) 
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URR UPLINK QUALITY INDICATION 
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Fig. 23B 
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URR HANDOVER COMMAND 
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Discriminator 
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Discrindnator 


M 


V 




0110 


SklD Indicator 


Skb Indicator 


M 


V 


16 
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UMA 

HANDOVER 
COMPLETE 
Messaqe Type 


Message type 


M 


V 


1 


00101100 


UCI 


UCI 


M 


V 


1 


0.1 or9 



URR HANDOVER COMPLETE 



Fig. 22 
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V 




0110 
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M 


V 


Vi 
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URR UPLINK 
QUAUTYIND 
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M 


V 


1 
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UCI 


ua 


M 


V 


1 
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URR UPLINK QUALITY INOIGATION 



Fig. 24 
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UIMARR 
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Protocol 
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M 


V 


)i 


0110 


Sl<ip Indicator 


Sldo Indicator 


M 


V 


% 


0000 


URR 

HANDOVER 
REQUIRED 
Messaae Tvpe 


Message type 


M 


V 


1 


0001 0001 


UCI 


UCI 


M 


V 


1 


0. 1 or9 




M 


V 


1 


10.5.2.6/GSM04.08 


Cell Identifier 
Ust 

(Prefeffed) 


Cell Identifier Ust 


M 


LV 


7n+2 
(0<n<8) 


32^.27/GSM08.08 


CI List 


CI Ust 


M 


LV 


n+1 

(0<n<8) 


CI Range: [0,63] 
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Fig. 25 
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URR HANDOVER COMMAND 



InfnrmsitfAn 

iiiiurmduun 

Element 


1 ypcinciciciiWB 


pppepncil 


pnrmat 


length 


Value 


UMM fin 

Protocol 
Discriminator 


rlOWCOl 

Discriminator 


M 

IVI 


U 
V 


7m 


0110 


oKip inaicaior 


oKip mojcaior 


Wl 


V 


yz 


nnnf> 


URR 

n/MMUUVcn 
COMMAND 

iVicbaayD lypo 


Message type 


M 


V 


1 


00101011 


UCI 


UCI 


M 


V 


1 


0.1 or9 


Cell Description 


oeii uescnpiion 


hit 


v 


9 




Description of 
me iirsi cnannei, 
after time 


Channel 
uescnpiion d 


M 


V 


3 


10.5.2.5a/GSM04.08 


Handover 
Reference 


nanaover 
Reference 


Wl 


v 


i 
I 




Power 

Command and 

Access lrP6 


Power command 
and access type 


M 


V 


1 


10.5.2.28a/GSM04.08 


Synchronization 
indication 


Synchronization 

indication 


0 


TV 


1 


10.5.2.39/6SM04.08 


rrecjuency onon 

Ublf dllcl 111 lie 


rrequency onon 

1 \<i\ 


\j 


TV 
1 V 


lU 




Proniionpu t iQt 

after lime 


FrAniifinpv 1 i^t 


c 


TLV 


4-131 


10 52 13/GSM04.08 


ppii Channel 

Description 


Cell Channel 
Description 


c 


TV 


17 


10.52.1 b/QSM04.08 


Mnda of the First 

IVIUVID wl Ulv 1 1191 

Channel 


Channel Mode 


0 


TV 


2 


10.5.2.6/GSM04.08 


Frequency 
Channel 
Sequence, after 
lime 


Frequency 

Channel 

Sequence 


c 


TV 


10 


10.5.2.12/GSM04.08 


Mobile 

Allocation, after 
time 


Mobile Allocation 


c 


TLV 


3-10 


10.5.2.21/GSM04.08 


StartinaTlme 


StartinaTlme 


0 


TV 


3 


10.5.2.38/6SM04.08 


Timing Advance 


Timinq Advance 


c 


TV 


2 


10.5.2.40/GSM04.08 


Frequency Short 
Ust. before time 


Frequency Short 
List 


c 


TV 


10 


10.5.2.14/GSM04.08 


Frequency List, 
before time 


Frequency List 


c 


TLV 


4-131 


10.5.2.13/GSM04.08 


Description of 
the first channel, 
before time 


Channel 
Description 2 


0 


TV 


4 


10.5.2.5a/GSM04.08 
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URR HANDOVER COMMAND (Continued) 



Information 
Element 
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Presence 


Format 
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Value 


Frequency 
Channel 
Sequence, after 
time 


Frequency 

Channel 

Sequence 


C 


TV 


10 


10.52.12/GSM04.08 


Mobile 

Allocation, after 
time 


Mobile Allocation 


C 


TLV 


3-10 


10.5.2.21/GSM04.08 


Startinq Time 


Starting Time 


0 


TV 


3 


10.5.2.38/GSM04.08 


Tintina Advance 


Timing Advance 


C 


TV 


2 


10.5.2.40/GSM04.08 


Frequency Short 
List, before time 


Frequency Short 
Ust 


C 


TV 


10 


10.5.2.14/GSM04.08 


Frequency List, 
before time 


Frequency List 


c 


TLV 


4-131 


10.5.2.13/6SM04.08 


Description of 
the first channel, 
before time 


Channel 
Description 2 


0 


TV 


4 


10.5^.5a/GSM04.08 


Frequency 
Channel 
Sequence, 
before time 


Frequency 

Channel 

Sequence 


c 


TV 


10 


10.5.2.12/GSM04.08 


Mobile 
Allocation, 
before time 


Mobile Allocation 


c 


TLV 


3-10 


10.52.21/GSM04.08 


CIPHER Mode 
Setting 


CIPHER Mode 
Setting 


0 


TV 


1 


10.5^.9/QSM04.08 1 


Multi-rate 
Confiauration 


Multi-rate 
Configuration 


0 


TLV 


4^ 


10.5.2.21aa/GSM04.08 1 



Fig. 26B 



URR HANDOVER FAILURE 



Information 
Element 


Type/Reference 


Presence 


Fonnat 


Length 


Value 


UMARR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 


% 


0110 


Sl<ip Indicator 


Sidp Indicator 


M 


V 




0000 1 


URR 

HANDOVER 
FAILURE 

Message Type 


Message type 


M 


V 


1 


0010 lOM 1 


UCI 


UCI 


M 


V 


1 


0. 1 or 9 B 


[■ll,'J:l;l;l»<.lll-jJ 


UMA RR Cause 


M 


V 


1 
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Connection Established (Dedicated) 



2800 



URR CLEAR REQUEST 



T 



:> 



A 
B 



Fig. 28 

URRRR CLEAR REQUEST 
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2802 



\^ Core X 
^A- Network J 

104 
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Element 
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UMARR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 


% 


0110 


SIdD Indicator 


SklD Indcator 


M 


V 




0000 


URR RR CLEAR 

REQUEST 

MessaoeTvpe 


Message type 


M 


V 


1 


0011 1111 


UCI 


UCI 


M 


V 


1 


0. 1 or9 



Fig. 29 
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URRRR RELEASE 
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URR RR RELEASE COMPLETE 



V 



B 
C 
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URRRR RELEASE 



Information 
Element 
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Format 


Length 


Value 


UMA RR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 




0110 


Skb Indicator 


Skip Indicator 


M 


V 


% 


0000 


URRRR 
RELEASE 
Message Tvpe 


Message type 


M 


V 


1 


00001101 


UCI 


UCI 


M 


V 


1 


0.1 org 


UMARR 
Cause 


UMA RR Cause 


M 


V 


1 




GPRS 
Resumption 


GPRS Resumption 


0 


TV 


1 


10.5.2.14C/GSM04.08 



Fig. 31 

URR RR RELEASE CX)MPLETE 



3000 



Information 
Element 


Type/Reference 


Presence 


Format 


Length 


Value 1 


UMARR 
Protocol 
Discriminator 


Protocol 
Discrlminaior 


M 


V 




0110 


SIq'd indicator 


SIdD Indicator 


M 


V 


Vi 


0000 


URRRR 
RELEASE 
COMPLETE 
Messaqe Type 


Message type 


M 


V 


1 


00001111 


UCI 


UCI 


M 


V 


1 


0.1 or9 1 



Fig. 32 



3002 



MS 1 ^ 

c 




AP 1,128 



3300 



URR PAGING REQUEST 



3302 



URR PAGING RESPONSE 



Fig. 33 



UNC '.^140 



A 
B 



wo 200S/114918 



PCT/US2005/016767 



27/30 



UF^R PAGING REQUEST 



Information 
Element 


Type/Reference 


Presence 


Format 


Length 


Value 


UMARR 
Protocol 
Oscriminator 


Protocol 
Discriminator 


M 


V 


% 


0110 


Skip Indicator 


Skip Indicator 


M 


V 




0000 


URR PAGING 

REQUEST 

MessaaeTvpe 


Message type 


M 


V 


1 


00100001 


UCI 


UCI 


M 


V 


1 


0.1 or9 


Spare Half 
Octet 


Spare Half Octet 


M 


V 


% 


10.5.1.8/GSM04.08 


Channel 
Needed 


Channel Needed 


M 


V 


% 


10.5.2.VGSM04.08 


Mobile Identity 


Mobile Idenlitv 


M 


LV 


2-9 


1 0.5.1 .4/GSM04.O8 



Fig. 34 ^ 



URR PAGING RESPONSE 



Information 
Element 


Type/Referenee 


Presence 


Format 


Length 


Value 


UMARR 
Protocol 

Discriminator 


Protocol 
Discriminator 


M 


V 




0110 


Skip Indicator 


Skip Indicator 


M 


V 




0000 


URR PAGING 
RESPONSE 
Message Type 


Message type 


M 


V 


1 


00100111 


UCI 


UCI 


M 


V 


1 


0. 1or9 


Ciphering Key 

Sequence 

Number 


Ciphering Key 
Sequence Number 


M 


V 


% 


10.5.1.2;QSM04.08 


Spare Half 
Octet 


Spare Half Octet 


M 


V 


% 


10.5.1.8/QSM04.08 


Mobile Station 
Classmark 


Mobile Station 
Classmark 2 


M 


LV 


4 


10.S.1.6/GSM04.08 


Mobile Identity 


UlElIIiEIESilii^^HI 


M 


LV 


2-9 


10.5.1 .4/QSM04.08 



Fig. 35 



3302 



wo 2005/114918 



PCT/US2005/016767 



2mo 



MS '^102 



AP '^128 



Connection Established (Dedicated) 



c 



3600 



URFiCUVSSMAiWENQUIIW 



3602 



URR CLASSMARK CHANGE 



T 



Fig. 36 



UNC ' ^140 



B 

C 



Information 
Element 


Type/Reference 


Presence 


Fonnat 


Length 


Value 1 


UiyiARR Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 


14 


0110 


Skip Indicator 


Skio Indicator 


M 


V 


Vt 


0000 


URR 

CLASSMARK 

ENQUIRY 

MessaaeTvoe 


Messsgetype 


M 


V 


1 


0001 0011 


UCI 


UCI 


M 


V 


1 


0.1 org 



URR CLASSMARK ENQUIRY 



Fig. 37 



S 

3600 



information 
Element 


Type/Reference 


Presence 


Format 


Length 


Value 


UMARR 
Protocol 
Discriminator 


Protocol 
Discriminator 


M 


V 


Vt 


0110 


SldD Indicator 


Skip Indicator 


M 


V 


% 


0000 


URR 

CUSSIVIARK 

CHANGE 

MessaqeTvpe 


Message type 


M 


V 


1 


0001 0110 


UCI 


UCI 


M 


V 


1 


0.1 or9 1 


Mobile Station 
Classmark 


Mobfle Station 
Classmark 2 


M 


LV 


4 


10.S.1.6/GSM04.08 | 


Additional 
Mobile Station 
Classmark 
Infonnation 


Mobile Station 
Classmark 3 


C 


TLV 


3-14 


10.5.1.7/GSM04.08 1 



URR CLASSMARK CHANGE 



Fig. 38 



3602 



wo 2005/114918 



PCTAJS2005/016767 



29/30 




wo 2005/114918 



PCT/US2005/016767 



30/30 



120 




4004 





UCENSED 

RAN 
ANTENNA 
SUB-SYSTEM 
(e.g.,6SM) 



UNLICENSED 
RAN ANTENNA 
SUB-SYSTEM ' 
(ag., 802.11, 
Bluetooth) 



LICENSED 
RANI/F 

LOGIC 



4OIO5 



.4006 



WLAN 

l/F 
LOGIC 



1 



UP l/F 
LOGIC 



-4012 



4000 '^s 




'^4002 



MOBILE STATION (MS) 



t 



102 



Fig. 40 



